This document (prEN 17206-1:2025) has been prepared by Technical Committee CEN/TC 433 “Entertainment Technology – Machinery, equipment and installations”, the secretariat of which is held by DIN.

This document is currently submitted to the CEN Enquiry.

This document will supersede EN 17206:2020 and EN 17206:2020/AC:2021.

CEN/TC 433/WG1 has reviewed EN 17206:2020 to adapt the standard to the technical progress, new requirements and changes in the standard referenced. The main changes are:

— Terminology related to axis definition has been removed and replaced with shared loads, group of machines, individual machines, and multiple machines, according to context.

— The definitions of shared and non-shared loads, control system, normal operation, positive load holding device, and friction load holding device have been added.

— Exceptional load and related failure conditions have been adopted, replacing the concept of Load at Failure, which is no longer referenced.

— Load assumptions for lower machinery and horizontal machinery have been revised.

— The drive system chapter has been restructured.

— Requirements for Direct Acting Capacity Limiters settings have been revised to align with EN 14492‑2 specifications.

— Traction sheaves specifications, following design requirements as per EN 81-50:2020, have been adopted.

— Clarifications concerning dynamic forces to be considered for UC1 and UC2 machinery have been added.

— Manual performer flying system requirements related to fibre ropes, operator lines, travel ropes, pulleys, block systems, sheaves, drums, track systems, and trolleys have been added.

— Requirements and specifications for machinery horizontal movements have been added.

— Load test of lifting equipment specifications has been revised.

— Specifications and description of protection against position deviation have been added.

— Upper machinery and Lower machinery Use Case requirements have been revised, with the addition of Use Cases for Upper machinery horizontal movements.

— Standard references to Eurocodes have been corrected.

— An informative Annex H for the calculation of exceptional loads has been added to the document.

— An informative Annex I for the definition of the partial safety factors and design risk factors has been added to the document.

EN 17206, Machinery for stages and other production areas consists of the following parts:

— Part 1: Safety requirements and inspections [the present document]

— Part 2: Safety requirements for stands and truss lifts of stands

Introduction

The purpose of this document is to produce European safety specifications for the design, manufacture and installation of lifting and load bearing equipment within the entertainment industry. Apart from the Machinery Directive, the Council Directive 2009/104/EC of 16 September 2009 concerning the minimum safety and health requirements for the use of work equipment by workers at work states in Annex II:

“3.1.3

Measures must be taken to ensure that workers are not present under suspended loads, unless such presence is required for the effective operation of the work

Loads may not be moved above unprotected workplaces usually occupied by workers.

Where that is the case, if work cannot be carried out properly any other way, appropriate procedures must be laid down and applied.”

This document considers situations that give rise to danger, such as moving or holding scenery or equipment:

a) over persons and/or unprotected areas;

b) in areas with low light conditions, limited visibility, for example while using stage fog and other masking effects.

These situations apply not only during performances, but also during rehearsals, technical set-up, preparations, installations and other situations. This document covers these hazards and suggests appropriate procedures to maintain safety.

Machinery installations are all technical installations and equipment used for operations in stage and production facilities in the entertainment industry. Such installations are used to lift, lower, suspend and carry loads (e.g. scenery, traverse systems, or lighting, film/video and sound equipment). They can also be used to move persons, and persons can stand under such equipment while the loads are at rest or in motion.

“Stages” are, for example, staging facilities and production areas in theatres, multipurpose halls, studios, production facilities for film, television or radio, concert halls, congress centres, schools, exhibition centres, trade-fair centres, museums, discotheques, amusement parks, sports facilities and open-air-theatres.

“Events” are, for example, concerts, shows, congresses, exhibitions, presentations, demonstrations, film or television recordings, etc.

This document considers permanently and temporarily installed lifting and movement equipment for stages and production areas within the entertainment industry.

This document does not consider the design or control of fire curtains.

Typical applications of this document include but are not limited to the following:

— acoustic doors;

— auditorium elevators;

— compensating elevators;

— cycloramas;

— fly bar systems (manually powered and motor driven);

— lighting bars;

— movable lighting towers;

— movable proscenium arches;

— orchestra elevators;

— performer flying systems;

— point hoists;

— revolving stages and turntables;

— rotators;

— scenery storage elevators;

— side stage and rear stage shutters;

— stage elevators;

— stage wagons;

— tiltable stage floors;

— track guided systems;

— trap elevators.

This document is a type C standard as stated in EN ISO 12100.

When provisions of this type C standard are different from those stated in type A or B standards, the provisions of this type C standard take precedence over the provision of the other standards, for machines that have been designed and built according to the provisions of this type C standard.

1.0 Scope

This document applies to machinery, machinery installations and machinery control systems used in places of assembly and in staging and production facilities for events and theatrical productions (stage machinery, for short). Such facilities include theatres, multi-purpose halls, exhibition halls; film, television and radio studios; concert halls, schools, bars, discotheques, open-air stages and other rooms for shows and events.

The document applies to machinery installations with guided or unguided loads.

This document covers machinery used in the entertainment industry including machinery that is excluded from the Machinery Directive (2006/42/EC) specifically Article 1, 2(j) which excludes “machinery intended to move performers during artistic performances”.

This machinery includes controls, electrical and electronic control systems, electrical and electronic equipment, hydraulic and pneumatic power supplies.

The principles in this document also apply to machinery installations based on new technologies or specially designed installations which are not expressly mentioned here but which nevertheless operate in a similar manner or are meant for similar purposes to the equipment listed above.

2.0 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

EN 81-50, Safety rules for the construction and installation of lifts - Examinations and tests - Part 50: Design rules, calculations, examinations and tests of lift components

EN 818‑1, Short link chain for lifting purposes — Safety — Part 1: General conditions of acceptance

EN 818‑7, Short link chain for lifting purposes — Safety — Part 7: Fine tolerance hoist chain, Grade T (Types T, DAT and DT)

EN 1090‑2, Execution of steel structures and aluminium structures — Part 2: Technical requirements for steel structures

EN 1090‑3, Execution of steel structures and aluminium structures — Part 3: Technical requirements for aluminium structures

EN 1993‑1, Eurocode 3: Design of steel structures

EN 1999‑1, Eurocode 9: Design of aluminium structures

EN 10204, Metallic products — Types of inspection documents

EN 12385‑4, Steel wire ropes — Safety — Part 4: Stranded ropes for general lifting applications

EN 13411 (all parts), Terminations for steel wire ropes — Safety

EN 13480‑3, Metallic industrial piping — Part 3: Design and calculation

EN 14492‑1, Cranes — Power driven winches and hoists — Part 1: Power driven winches

EN 14492‑2, Cranes — Power driven winches and hoists — Part 2: Power driven hoists

EN 60034‑1, Rotating electrical machines — Part 1: Rating and performance (IEC 60034‑1)

EN 60204‑1, Safety of machinery — Electrical equipment of machines — Part 1: General requirements

EN 60204‑32, Safety of machinery — Electrical equipment of machines — Part 32: Requirements for hoisting machines

EN IEC 60947‑4‑1, Low-voltage switchgear and controlgear — Part 4-1: Contactors and motor-starters — Electromechanical contactors and motor-starters (IEC 60947‑4‑1)

EN 60947‑5‑1, Low-voltage switchgear and controlgear — Part 5-1: Control circuit devices and switching elements — Electromechanical control circuit devices (IEC 60947‑5‑1)

EN IEC 61000‑6‑2, Electromagnetic compatibility (EMC) — Part 6-2: Generic standards — Immunity standard for industrial environments (IEC 61000‑6‑2)

EN IEC 61000‑6‑4, Electromagnetic compatibility (EMC) — Part 6-4: Generic standards — Emission standard for industrial environments (IEC 61000‑6‑4)

EN 61326‑3‑1, Electrical equipment for measurement, control and laboratory use — EMC requirements — Part 3-1: Immunity requirements for safety-related systems and for equipment intended to perform safety-related functions (functional safety) — General industrial applications

EN IEC 61439‑1, Low-voltage switchgear and controlgear assemblies — Part 1: General rules (IEC 61439‑1)

EN 61508 (all parts), Functional safety of electrical/electronic/programmable electronic safety-related systems (IEC 61508)

EN 62061, Safety of machinery — Functional safety of safety-related electrical, electronic and programmable electronic control systems

EN 81346‑1, Industrial systems, installations and equipment and industrial products — Structuring principles and reference designations — Part 1: Basic rules (IEC 81346‑1)

EN IEC/IEEE 82079‑1, Preparation of information for use (instructions for use) of products — Part 1: Principles and general requirements (IEC/IEEE 82079-1)

EN ISO 12100:2010, Safety of machinery — General principles for design — Risk assessment and risk reduction (ISO 12100:2010)

EN ISO 13849‑1, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design

EN ISO 13849‑2, Safety of machinery — Safety-related parts of control systems — Part 2: Validation

EN ISO 13850, Safety of machinery — Emergency stop function — Principles for design (ISO 13850)

EN ISO 13854, Safety of machinery — Minimum gaps to avoid crushing of parts of the human body (ISO 13854)

EN ISO 13857, Safety of machinery — Safety distances to prevent hazard zones being reached by upper and lower limbs (ISO 13857) )

3.0 Terms and definitions

For the purposes of this document, the following terms and definitions apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https://www.iso.org/obp/

— IEC Electropedia: available at https://www.electropedia.org/

3.1 General terms

3.1.1

competent person

person with sufficient practical and theoretical knowledge and experience to carry out the person’s duties, and who is aware of the limits of the person’s competency, expertise and knowledge

3.1.2

drive system

part of a load bearing machine that executes movement and holding of the load and which converts energy into movement

Note 1 to entry: See Figure 2 c), Figure 3 c) and Figure 4 c).

3.1.3

emergency stop

emergency stop function

E-stop

function which is intended to

— avert arising or reduce existing hazards to persons, damage to machinery or to work in progress, and

— be initiated by a single human action

Note 1 to entry: ISO 13850 gives detailed provisions.

[SOURCE: EN ISO 12100:2010, 3.40, modified — Term “E-Stop” added]

3.1.4

failure

termination of the ability of an item to perform a required function

Note 1 to entry: After failure the item has a fault.

Note 2 to entry: “Failure” is an event, as distinguished from “fault”, which is a state.

Note 3 to entry: This concept as defined does not apply to items consisting of software only.

Note 4 to entry: In practice the terms “failure” and “fault” are often used synonymously.

[SOURCE: IEV 192-03-01]

3.1.5

fault

state of an item characterized by inability to perform a required function, excluding the inability during preventive maintenance or other planned actions, or due to lack of external resources

Note 1 to entry: A fault is often the result of a failure of the item itself, but can exist without prior failure.

Note 2 to entry: In the field of machinery, the English term “fault” is commonly used in accordance with the definition in IEV 192‑04‑01, whereas the French term “défaut” and the German term “Fehler” are used rather than the terms “Panne” and “Fehlzustand” that appear in the IEV with this definition.

Note 3 to entry: In practice, the terms “fault” and “failure” are often used synonymously.

[SOURCE: EN ISO 12100:2010, 3.33]

3.1.6

fly bar

fly bar (e.g. bar or truss) having several load bearing lines for lifting, lowering, and suspending loads, with the load being either uniformly distributed or concentrated (point load)

Note 1 to entry: A distinction is made between manually powered flying systems (e.g. manual counterweight systems) and motor-driven systems (e.g. with electric or hydraulic drive).

3.1.7

hazard

potential source of harm

Note 1 to entry: The term “hazard” can be qualified in order to define its origin (for example, mechanical hazard, electrical hazard) or the nature of the potential harm (for example, electric shock hazard, cutting hazard, toxic hazard, fire hazard).

Note 2 to entry: The hazard envisaged by this definition either

— is permanently present during the intended use of the machine (for example, motion of hazardous moving elements, electric arc during a welding phase, unhealthy posture, noise emission, high temperature), or

— can appear unexpectedly (for example, explosion, crushing hazard as a consequence of an unintended/unexpected start-up, ejection as a consequence of a breakage, fall as a consequence of acceleration/deceleration).

Note 3 to entry: The French term “phénomène dangereux” should not be confused with the term “risque”, which was sometimes used instead in the past.

[SOURCE: EN ISO 12100:2010, 3.6]

3.1.8

hazard zone

danger zone

space within and/or around machinery in which a person can be exposed to a hazard

3.1.9

lifting accessory

component or equipment, allowing the load to be held, which is placed between the lifting machinery and the load or on the load itself, or which is intended to constitute an integral part of the load and which is independently placed on the market

3.1.10

load bearing element

parts of a machine between the load and the machinery anchor point

3.1.11

load bearing equipment

assembly of load bearing elements, including the drive mechanism

Note 1 to entry: See Figure 2 b), Figure 3 b) and Figure 4 b).

3.1.12

load carrying device

part of stage machinery which directly carries the intended load

EXAMPLES Fly bar of a bar hoist, platform of an elevator, truss, hook of a point hoist.

Note 1 to entry: For trusses refer to EN 17115.

Note 2 to entry: See Figure 2 d), Figure 3 d) and Figure 4 d).

3.1.13

load securing device

mechanical device that can bring a load to a defined stop and prevents unintentional movement

EXAMPLES A brake, self-braking worm gear, shut-off valve.

3.1.14

load holding device

device that prevents unintentional movement of an already stationary load

EXAMPLES Rope lock, locking pin, brake.

3.1.15

machinery installation

all elements between the load and the machinery anchor point

Note 1 to entry: See Figure 2 a); Figure 3 a); Figure 4 a).

3.1.16

manual counterweight system

manually powered fly bar moved by means of an operating rope, where the load is fully or partially balanced by counterweights carried in a guided frame connected to the flying bar

3.1.17

rated speed

maximum speed at which the machine is designed to operate

3.1.18

point hoist

lifting equipment having one load bearing line for lifting, lowering, and suspending loads

3.1.19

protective measure

measure intended to achieve risk reduction

3.1.20

risk

combination of the probability of occurrence of harm and the severity of that harm

3.1.21

safeguard

guard or protective device

[SOURCE: EN ISO 12100:2010, 3.26]

3.1.22

stage elevator

part of a horizontal or inclined (tilted) stage, performance area, studio or auditorium floor which can be moved vertically up and/or down, including all necessary drive elements

EXAMPLE 1 Elevator which is a permanent part of the stage, performance area, studio or auditorium floor (e.g. orchestra elevator, single- or double-deck stage elevator, stage compensating elevator, scenery storage elevator or auditorium elevator).

EXAMPLE 2 Elevator which is not a permanent part of the stage, performance area, studio or auditorium floor, which is used primarily for scenic purposes and which normally rests below stage (e.g. stage trap elevator).

Note 1 to entry: A stage elevator at rest can be part of the stage.

3.1.23

stage elevator platform

part of a stage elevator which supports the load

3.1.24

normal operation

intended use according to the manufacturers’ specification and defined in the instructions, excluding the use of muting and maintenance functions

3.1.25

positive load holding device

load holding device that forms a fixed connection to prevent unintentional movement (e.g. locking pin)

3.1.26

friction load holding device

load holding device that relies on friction force to prevent unintentional movement (e.g. piston clamping device, rope lock, brake)

3.1.27

traction sheave

frictionally engaged drive element for ropes

3.1.28

traction winch

winch with a traction sheave driving the rope

3.1.1 Loads, forces and pressures

Table 1 — Loads and forces

Loads and forces in normal operation
	ENTERTAINMENT LOAD LIMIT (ELL)
+	WEIGHT OF LOAD CARRYING DEVICE
=	SYSTEM LOAD
+	DYNAMIC FORCES
=	CHARACTERISTIC LOAD
x 2	= DESIGN LOAD

Exceptional loads and forces
	ENTERTAINMENT LOAD LIMIT (ELL)
+	WEIGHT OF LOAD CARRYING DEVICE
=	SYSTEM LOAD
+	DYNAMIC FORCES DURING EXCEPTIONAL CONDITIONS
=	EXCEPTIONAL LOAD
x 1	= DESIGN LOAD

3.2.1

characteristic load

[entertainment]

characteristic load is the sum of the system load and the dynamic forces occurring during normal operation

Note 1 to entry: Normal operation also includes holding of loads at rest.

3.2.2

characteristic load pressure

in a hydraulic system, the pressure generated by the characteristic load

3.2.3

design load

load to be used for calculation/validation of a specific component according to the standards and the technical literature applicable for the specific component

Note 1 to entry: For machinery, design load is obtained by doubling the characteristic load (or one time the exceptional load, depending on the specific condition being considered) of the component. See 5.1.

3.2.4

entertainment load limit

ELL

maximum load that an item of lifting equipment is designed to raise, lower or sustain in an entertainment industry application

3.2.5

entertainment load limit at rest

ELL/R

maximum load that an item of lifting equipment is designed to sustain at rest in an entertainment industry application

Note 1 to entry: Due to additional measures (such as locking pins in elevators), the Entertainment Load Limit at Rest could be higher than the entertainment load limit that the machine is capable of moving.

3.2.6

exceptional load

loads occurring infrequently, usually neglected in fatigue assessment, determining an exceptional loading condition

Note 1 to entry: It is the sum of the system load and the dynamic forces occurring due to exceptional conditions.

Note 2 to entry: Exceptional conditions may include but are not limited to the following:

a) failure in electric power supply;

b) pressure failure in hydraulic system;

c) activation of a safety device;

d) stalling of the motor due to snagging of the load/load carrying device;

e) sudden lifting of a load started with no tension on the load bearing elements;

f) test loads;

g) loads due to buffer forces or mechanical stops;

h) loads due to tilting forces;

j) loads due to unintentional loss of load;

k) loads caused by failure of mechanism or components;

l) loads caused during assembly and dismantling;

Note 2 to entry: In EN 17206:2020 previously referred to as “Load at Failure”.

3.2.7

nominal pressure

pressure stated by the manufacturer of the component

3.2.8

no shared loads

single machine that performs by itself the movement of a single load

3.2.9

operating pressure

pressure generated by the system

3.2.10

shared loads

two or more machines that may be operated independently and are installed into an assembly of machinery to perform the movement of a single shared load

3.2.11

system load

sum of entertainment load limit and the weight of the load carrying device

3.2.12

system pressure

operating pressure limited by a pressure device

3.2.13

test load

load used when testing a lifting device, load bearing equipment, or load carrying or securing devices

Note 1 to entry: See 9.3.2.3 for further details.

3.1.2 Electrical equipment and control systems

3.3.1

control circuit

circuit used for the operational control of stage machinery and for protection of the power circuits

3.3.2

control device

device for the activation of a movement, e.g. lever, push button, wheel

3.3.3

controlled stop

stopping of machine motion with power to the machine actuators maintained during the stopping process

[SOURCE: EN 60204‑1:2018, 3.1.14]

3.3.4

electrical/electronic/programmable electronic system

E/E/PE system

system for control, protection or monitoring based on one or more electrical/electronic programmable electronic (E/E/PE) devices, including all elements of the system such as power supplies, sensors and other input devices, data highways and other communication paths, and actuators and other output devices

Note 1 to entry: For structure and terminology, see Figure 1.

EXAMPLE Electrical/electronic/programmable electronic devices include:

a) electro-mechanical devices (electrical);

b) solid-state non-programmable electronic devices (electronic); and

c) electronic devices based on computer technology (programmable electronic).

Key

1	input devices (e.g. sensors, switches)	4	E/E/PE device
2	input interfaces A-D-converters	5	output interfaces D-A-converters
3	communications	6	output devices, final elements (e.g. actuators)

NOTE The E/E/PE device is shown centrally located but such device(s) could exist at several places in the E/E/PE system.

Figure 1 — Electrical/electronic programmable electronic system (E/E/PE system) – Structure and terminology

3.3.5

equipotential bonding

provision of electric connections between conductive parts, intended to achieve equipotentiality

[SOURCE: IEV 195‑1‑10]

3.3.6

load profile monitoring

programming of a specific load condition followed by monitoring of the load with an automatic stop of the machine once the measured load deviates from the programmed load

3.3.7

muting

temporary suspension of a safety function by the SRP/CS

3.3.8

overload condition

condition in which the load has gone above a preset value

3.3.9

performance level

discrete level used to specify the ability of safety related parts of control systems to perform a safety function under foreseeable conditions

[SOURCE: EN ISO 13849‑1:2023, 3.1.23, modified — Note 1 removed.]

3.3.10

power source failure

change in the electrical or fluid (liquid or gas) power supply that could adversely affect the performance of a machine

Note 1 to entry: This might include under-voltage, over-voltage, phase loss, incorrect phase sequence and fluid over-pressure or fluid under-pressure.

3.3.11

protective bonding circuit

protective conductors and conductive parts connected together to provide protection against electric shock in the event of an insulation failure

[SOURCE: EN 60204‑1:2018, 3.1.50]

3.3.12

protective conductor

conductor required by some measures for protection against electric shock for electrically connecting any of the following parts:

a) exposed conductive parts;

b) extraneous conductive parts;

c) main earthing terminal;

d) earth electrode; and

e) earthed point of the source or artificial neutral

[SOURCE: EN 61984:2009, 3.35]

3.3.13

redundancy

application of more than one device or system, or part of a device or system, with the objective of ensuring that in the event of one failing to perform its function another is available to perform that function

[SOURCE: EN 60204‑32:2008, 3.57]

3.3.14

safety function

function that is intended to achieve or maintain a safe state for the machine in respect of a specific hazardous event

3.3.15

safety integrity level

SIL

discrete level (one out of a possible three) for specifying the safety integrity requirements of the safety-related control functions to be allocated to the SRECS, where safety integrity level three has the highest level of safety integrity and safety integrity level one has the lowest

Note 1 to entry: See EN 61508‑4:2010, 3.5.8.

Note 2 to entry: SIL 4 is not considered in this document, as it is not relevant to the risk reduction requirements normally associated with machinery. For requirements applicable to SIL 4, see EN 61508‑1 and EN 61508‑2.

3.3.16

slack condition

condition in which a wire or load bearing device is no longer supporting its attached load

Note 1 to entry: Commonly referred to as a slack wire condition.

3.3.17

safety-related part of a control system

SRP/CS

part of a control system that responds to safety-related input signals and generates safety-related output signals

Note 1 to entry: The combined safety-related parts of a control system start at the point where the safety-related input signals are initiated (including, for example, the actuating cam and the roller of the position switch) and end at the output of the power control elements (including, for example, the main contacts of a contactor).

Note 2 to entry: If monitoring systems are used for diagnostics, they are also considered as SRP/CS.

[SOURCE: EN ISO 13849‑1:2023, 3.1.1]

3.3.18

uncontrolled stop

stopping of machine movement by loss of or removal of power to the machine

3.3.19

underload condition

condition in which the load has gone below a preset value

3.3.20

control system

system which responds to an input from, for example, the process, other machine elements, an operator, external control equipment, and generates an output(s) causing the machine to behave in the intended manner

[SOURCE: EN 62061:2005+A2:2015, modified — The original term was “machine control system”.]

3.1.3 Tolerances relating to movement

3.4.1

group synchronization tolerance

permissible deviation in the position in relation to another machine within a group

3.4.2

group synchronization tolerance in the event of failure

permissible deviation in the position in relation to another of the machine within a group during (moving) and after (stationary) an event of failure.

4.0 Hazards

4.1 General

When designing and using lifting and load bearing equipment as in this document, all foreseeable hazards shall be identified.

Only competent persons shall be responsible for:

a) describing the intended use;

b) risk assessment.

After risk assessment has been carried out, the appropriate measures to be taken shall be established for specific hazards. The risk assessment can be carried out on the basis of EN ISO 12100 or according to the example hazards listed in Annex A, Table A.1. Suitable facilities and provisions to enable the recovery of performers and other persons shall be provided in the event of any of the identified hazards occurring.

The following steps shall be taken when selecting protective measures:

c) specify the limits of the machinery (intended use, reasonably foreseeable misuse, space limits, the foreseeable life limit, and wear factors);

d) identify hazards and estimate risks (see Annex E and Annex F for examples of risk estimation and Annex G for hazard application examples);

e) avoid hazards by means of inherently safe design measures and reduce risks as much as possible;

f) inform users of any residual risks (information for use).

4.1.1 List of significant hazards

Table 2 shows a list of significant hazards, hazardous situations and hazardous events that could result in risks to persons during normal use and foreseeable misuse. It also contains the relevant clauses in this document that are necessary to reduce or eliminate the risks associated with those hazards.

Table 2 — List of significant hazards

	Hazards	Relevant clause(s) in this document
	The significant hazards below are based upon EN 12100:2010
1	Mechanical hazards due to:
1.1	Acceleration, deceleration	5.1; 5.3; 6.3; 6.4; 6.5
1.2	Angular parts	5.1; 6.3
1.3	Approach of moving element to a fixed part	5.1; 6.3
1.5	Elastic elements	5.1; 6.3
1.6	Falling objects	5.1; 5.3; 5.4; 5.6
1.7	Gravity	5.1; 5.3; 5.6
1.8	Height from the ground	5.1; 5.3;
1.9	High pressure	5.6.5
1.10	Instability	5.1; 5.3; 5.6
1.11	Kinetic energy	5.1; 5.3; 6.3
1.12	Machinery mobility	5.1; 6.3; 7.3.4.14; 7.3.4.15
1.13	Rotating elements	5.1; 6.3
1.14	Rough, slippery surface	—
1.15	Sharp edges	5.1; 6.3
1.16	Stored energy	5.6.5
2	Electrical hazards due to:
2.1	Electromagnetic phenomena	7.1; 7.1.3.1
2.2	Electrostatic phenomena	7.1; 7.2.1; 7.2.3
2.3	Live parts	7.1; 7.2.2; 7.2.3
2.4	Overload	7.1; 7.2.2; 7.2.3
2.5	Part which have become live under fault conditions	7.1; 7.2.2; 7.2.3
2.6	Short-circuit	7.1; 7.2.2; 7.2.3
2.7	Thermal radiation	7.1; 7.2.2; 7.2.3
3	Thermal hazards due to:
3.1	Explosion	—
3.2	Flame	—
3.3	Objects or materials with high or low temperature	5.6
3.4	Radiation from heat sources	—
4	Noise hazards due to:
4.1	Cavitation phenomena	—
4.2	Exhausting system	—
4.3	Gas leaking at high speed	5.6.5
4.4	Manufacturing process (stamping, cutting, etc.)	—
4.5	Moving parts	5.6
4.6	Scraping surfaces	—
4.7	Unbalanced rotating parts	5.6
4.8	Whistling pneumatics	—
4.9	Worn parts	—
5	Vibration hazards due to:
5.1	Cavitation phenomena	—
5.2	Misalignment of moving parts	5.4.1
5.3	Mobile equipment	6.3
5.4	Scraping surfaces	—
5.5	Unbalanced rotating parts	5.6
5.6	Vibrating equipment	5.4.1; 5.6
5.7	Worn parts	—
6	Radiation hazards
6.1	Low frequency, radio frequency radiation	7.1.3.1; 7.2.4.4
6.2	Infrared, visible and ultraviolet lights	7.2.4.4
6.3	Lasers	7.3.1; 7.3.4.2; 7.3.4.14; 7.3.4.16; 7.5.1
7	Material and substances hazards
7.1	Hazards from contact with or inhalation of harmful fluids, gases, mists, fumes and dust	5.6.3; 7.3.4.10
7.2	Fire or explosion hazards	5.6.5
8	Ergonomic hazards
8.1	Access	6.1; 6.2; 6.3; 6.4; 6.5; 7.5.1
8.2	Design or Location of indicators and visual display units	7.2.4.2; 7.8.1;
8.3	Design, location or identification of control devices	7.2.4.2; 7.8.1
8.4	Effort	5.6.7; 5.6.8; 6.5; 7.8
8.5	Human error, human behaviour	7.2.4.2
8.6	Local lighting	7.8.1
8.7	Mental overload/underload	—
8.8	Posture	6.1; 6.2; 6.3; 6.4; 6.5
8.9	Repetitive activity	6.1; 6.2; 6.3; 6.4; 6.5
8.10	Visibility	6.1
9	Hazards associated with the environment in which the machine is used
9.1	Dust and fog	—
9.2	Electromagnetic disturbance	7.1.3.1; 7.2.3.1
9.3	Lightning	7.2.3.1
9.4	Moisture	7.1.3.2
9.5	Pollution	—
9.6	Snow	—
9.7	Temperature	7.1.3.2; 7.2.3.1
9.8	Water	7.1.3.2
9.9	Wind	—
9.10	Lack of oxygen	6.4.1
10	Combination of hazards
	Additional hazards and hazardous events due to lifting procedures, load or machinery collisions due to:
11	Unintentional movements hazards
11.1	Failure/malfunctioning of the control system	7.3.4; 7.4
11.2	Software errors	7.6; 7.7; 7.8
11.3	Uncontrolled movements	5.6
11.4	Unintentional movement due to mechanical failure	5.1; 5.3; 5.4; 5.5; 5.6
12	Improper use hazards
12.1	Unauthorized start-up	7.1.1; 7.2.4.2; 7.3.1
12.2	Unauthorized use	7.1.1; 7.2.4.2
12.3	Improper operation	8
12.4	Insufficient instructions for the operator	8
	Additional hazards, hazardous situations and hazardous events due to lifting
13	Mechanical hazards and hazardous events
13.1	Lack of stability	5.1; 5.3; 5.4; 5.5; 5.6
13.2	Uncontrolled loading – overloading – overturning moments exceeded	7.3.4.3; 7.3.4.4; 7.3.4.11
13.3	Unexpected/unintended movement of loads	5.6.1
13.4	Inadequate holding devices/accessories	5.4
13.5	Collision of more than one machine	7.3.4.14
13.6	From insufficient mechanical strength of parts	5.1; 5.3; 5.4; 5.5; 5.6
13.7	From inadequate design of pulleys, drums	5.5
13.8	From unsuitable selection of chains, ropes, lifting and accessories and their inadequate integration into the machine	5.4
13.9	From abnormal conditions of assembly/testing/use/maintenance	8
13.10	From the effect of load on persons (impact by load or counterweight)	6.1; 6.2; 6.3; 6.4; 6.5
13.11	Incorrect arrangement of machinery parts	5.1; 5.6
13.12	Incorrect installation, testing, use and maintenance	5.6; 8
	Additional hazards, hazardous situations and hazardous events due to the lifting or moving of persons
14	Mechanical and unintentional movement hazards
14.1	Inadequate mechanical strength – inadequate working coefficients	5.1; 5.6
14.2	Failure/malfunctioning of the control system	7.3.1; 7.3.2; 7.3.3; 7.3.4
14.3	Software errors	7.6
14.4	Uncontrolled movements	5.1; 5.6

5.0 Design requirements

5.1 General

The basic safety concept laid down in this document is based on the principles of intrinsic safety or single fault safety design. This is achieved either through doubling the characteristic load in calculations or through redundancy.

Load bearing elements shall be designed such that the design load is twice the characteristic load.

In addition, safety factors from calculation methods should be applied.

In the design of machinery intended for lifting operation at speeds up to 0,2 m/s, without people in the hazard zone, dynamic forces may be omitted from the characteristic load calculation.

To account for failure or exceptional conditions, load bearing elements shall be designed such that the design load is 1 times the exceptional load.

Guidelines on how to calculate the “dynamic forces at exceptional load” can be found in EN 13001‑2:2021. See especially EN 13001-2:2021, 4.2.2.5 “Loads caused by acceleration of drives”.

If the failure of load bearing elements does not lead to any hazardous situation, then it is acceptable that the design load is equal to the characteristic load.

Load bearing elements shall be designed according to appropriate standards, for example EN 1993‑1 (Eurocode 3) for steel constructions and EN 1999‑1 (Eurocode 9) for aluminium constructions.

All welding of fabrications shall be constructed and manufactured according to EN 1090‑2 and EN 1090‑3.

Natural frequency and lateral torsional buckling and lateral buckling of the structures shall be considered.

Inflammable elements are permitted only where design measures ensure that their destruction does not lead to the load carrying device and its load falling.

Stage machinery load bearing elements are for example:

a) load bearing equipment, see 5.4;

b) drive systems; see 5.6;

c) load carrying devices, see 5.7.

Examples of these are given in 5.2.

5.1.1 Examples of machine installations showing the groups

Examples of machine installations are given in Figure 2 to Figure 4.


a) Machinery installation	b) Load bearing equipment

c) Drive system	d) Load carrying device

e) Scenery or equipment on the fly bar

Figure 2 — Schematic representation of a bar hoist winch system


a) Machinery installation	b) Load bearing equipment

c) Drive system	d) Load carrying device

e) Scenery or equipment on the elevator floor

Figure 3 — Schematic representation of a stage elevator


a) Machinery installation	b) Load bearing equipment

c) Drive systems	d) Load carrying device

e) Scenery or equipment on the truss

Figure 4 — Schematic representation of a system using multiple hoists

5.1.2 Additional load assumptions

5.1.3 Load assumptions for stage elevators

The following loads shall be specified:

ELL;
ELL/R;
distributed load;
point loads.

The distributed load with the stage elevator at rest as permanent part of the stage floor shall be at least the same as the surrounding stage floor; when the stage elevator is used solely for artistic purposes and not as a permanent part of the stage floor construction, it may have a different or lower distributed load.

To obtain sufficient longitudinal and lateral rigidity the elevator should be capable of withstanding a horizontal force of at least 5 % of the ELL when in motion, and 5 % of the ELL/R when at rest.

5.1.4 Load assumptions for stage wagons and turntables

The following loads shall be specified:

ELL;
ELL/R;
distributed load;
point loads.

The distributed load with the stage wagon or turntable at rest as permanent part of the stage floor shall be at least the same as the surrounding stage floor; when the stage wagon or turntable is used solely for artistic purposes and not as a permanent part of the stage floor construction, it may have a different or lower distributed load.

5.2 Load bearing equipment

5.2.1 General

It is possible to use a single load bearing line.

All elements shall be secured against unintentional loosening.

For example, when quick links are used, the direction of the link shall be with the nut screwing downwards when the link is closed.

All structural elements of load bearing equipment shall be made of non-flammable materials.

Synthetic or natural fibre ropes may be only used if the risk assessments indicate it is safe to do so.

5.2.2 Load bearing lines

Wire ropes

Wire rope which complies with EN 12385‑1, EN 12385‑2, EN 12385‑4, and EN 12385‑5 may be used as load bearing lines.

Wire ropes excluding terminations used as load bearing lines shall meet the requirements for a safety factor of at least 10 at characteristic load, and for a safety factor of at least 2 at exceptional load, where the safety factor is the quotient of the minimum breaking load and the partial tensile force acting at characteristic load or at exceptional load respectively.

When wire-ropes are used to push-pull tracking systems or guided wagons and the failure of a wire rope does not lead to the load carrying device and its load failing, then it is acceptable that a safety factor of at least 5 at characteristic load.

When wire-ropes do not travel over pulleys or drums, a lesser safety-factor may be used following a risk assessment.

Wire ropes shall be provided with a type 2.2 inspection document as in EN 10204 confirming testing as in EN 12385‑4.

If a cover (plastic or textile) is used it shall be possible to inspect the entire length of the wire rope.

Jacketed wire ropes shall not be used as part of the machinery installation.

Chains

If short link steel chains are used in machinery installations, these are to be calibrated and tested as in EN 818‑7. Short link steel chains used to carry loads shall meet the requirements for a safety factor of at least 8 at characteristic loading, in relation to the breaking force as specified in EN 818‑7. Exceptional load shall not give rise to permanent deformation.

Chains shall be provided with a type 2.2 inspection document as in EN 10204 confirming testing as in EN 818‑7. Other types of chain (e.g. roller chains) shall meet the above requirements by analogy. Type-specific characteristics are to be taken into consideration.

5.2.3 Load bearing lines terminations

Wire rope terminations

The choice of wire rope termination shall take into account the type of wire rope used.

Terminations shall be such that at least 80 % of the rope’s minimum breaking force is maintained.

The rope end connection shall be designed so that its condition can be checked by inspection. End connections shall meet the requirements of EN 13411.

Use of grips as in EN 13411‑5 is not allowed as a means to terminate load bearing lines.

Detachable wire rope terminations

Detachable wire rope terminations may be:

a) asymmetric wedge socket as in EN 13411‑6;

b) symmetric wedge socket in EN 13411‑7.

Detachable terminations shall be secured against self-detachment, for instance by using grips as in EN 13411‑5, which shall be attached according to the wedge socket manufacturer’s instructions (see Figure 5 and Figure 6 for examples).

The connection to the fly bar shall allow free movement in all horizontal directions (see Figure 5).

Key

1	wire rope deflection
	D : d ratio shall maintain 100 % of the wire rope integrity according to the manufacturer’s specification, or, where the manufacturer’s specification is not available, the rope deflection D : d ratio shall not be less than 7
D	diameter of deflection
d	diameter of rope
2	fly bar
3	sliding clip

Figure 5 — Sliding pipe clip as an example of a device for compensating the length of a wire rope

Key

1	grip as in EN 13411‑5
2	asymmetric wedge socket
3	quick link with screw caps
4	fly bar with welded lug

Figure 6 — Example of a means of suspending a fly bar

Fixed or Non-detachable wire rope terminations

Examples of non-detachable terminations for wire rope are:

a) splices as in EN 13411‑2;

b) ferrules as in EN 13411‑3;

c) swage terminals as in EN 13411‑8.

Load Hooks

Hooks shall be designed in accordance with the state of the art, e.g. in accordance with EN 14492‑1 and EN 14492‑2.

Hooks shall be such that the unintentional detachment of the load is prevented. This can be achieved by:

a) a safety device; or

b) the shape of the hook.

Hooks equipped with a safety-latch fulfil these requirements.

End connections for steel chains

Chain end terminations shall be designed and manufactured in such a way that they shall withstand 100 % of the chain’s minimum breaking force before failure occurs. Roller chain terminations shall be designed and calculated with clear indications of the limits of bending in the unfavourable plane. The manufacturer shall take these limits into account when installing roller chains in entertainment lifting machinery. A pivoting or hinging attachment shall prevent unintended side loading.

Threaded connections shall be locked to prevent self-loosening. The condition of the fastening shall be verifiable.

5.3 Winding devices and diverter pulleys

5.3.1 Winding devices for wire ropes

Where round ropes are used, a wire rope drum with a helical groove shall be used to take up the rope. Other lifting devices that do not use a drum are possible.

It is preferable that round wire rope may only be wound in one layer. When using pile wind drums, each rope shall have its own winding chamber and it shall be ensured that the rope is layered in such a manner that the rope centres line up.

In order to preserve the wire rope integrity wire rope crossovers and improper winding shall be prevented or detected. This applies to both single and multiple layer drums.

The attachment of the rope to the drum shall be designed to take 80 % of the calculated required minimum breaking force either by friction by the remaining turns on the drum or by end termination or a combination of both.

When clamps are used to attach the rope, a single failure shall not lead to the attachment becoming ineffective.

Design measures shall ensure that the fleet angle of the rope from the groove of the drum or pulley when it is being pulled up or down, even when it is under loaded or slack shall never exceed 4° on either side, but it is preferred that the maximum should not be more than 1,5°.

The rope drum diameter, measured from the rope centreline to centreline, shall not be less than 18 times the rope diameter.

5.3.2 Diverter pulleys for round wire ropes

The diverter pulley diameter, measured from the rope centreline to centreline, shall be equal to at least 20 times the rope diameter.

Diverter pulleys shall be designed in such a manner as to prevent the rope from coming out of the groove of the sheave.

The bottom of the rope groove shall be a circular arc.

The radius of the rope groove should be between 0,52 d and 0,56 d where d is the nominal diameter of the rope.

The radius shall be greater than 0,52 d and shall not exceed the nominal wire rope diameter.

The opening angle of the rope pulley shall be symmetrical and between 30° and 60°. The depth of the grooves shall not be less than 1,4 × nominal rope diameter.

5.3.3 Drive and idler sprockets for steel chains

Calculations for chain drives with short steel link chains shall be made in accordance with EN 818‑1 and with EN 818‑7.

Chain drives shall be provided with a device which ensures that the chain runs properly over chain drive sprockets and chain guide wheels and which prevents the chain from jumping out, twisting and jamming.

5.3.4 Traction sheaves

The traction sheave shall be designed in such a way that it does not slip under double the characteristic load or 1,0 × the exceptional load, whichever is greater.

For any application where traction slippage could represent a source of hazard, design requirements as per EN 81-50:2020, 5.11 shall be followed. The traction sheave shall have a higher hardness than the tensile strength of the rope material.

The risk assessment may demonstrate that a load securing device could not be required.

If the rope is not endless then a mechanical stop on the rope shall be provided.

Means shall be provided to prevent the ropes from running off the sides of the traction sheave.

The machinery design should aim for a zero-fleet angle into the traction sheave.

5.4 Drive systems

5.4.1 General

Drive systems shall be designed so as to preclude unintentional hazardous movements.

Between the load carrying and the load securing device, all components of drive systems shall be designed such that twice the characteristic load shall not give rise to permanent deformation or failure of the component. The selection of gearboxes or components of the transmission drive train should take a minimum of 400 h at rated speed at twice the characteristic load as the basis for calculations, unless a longer time is appropriate.

NOTE The figure of 400 h or any other time used above is purely a basis for calculations and does not necessarily correspond to the operating time at 1 x characteristic load. The operating time can be determined by the manufacturer.

Additional components that are dynamically loaded or subject to wear shall be assessed and designed for 1 time the characteristic load in relation to fatigue strength or an expected safe operating period to be agreed between the client and the manufacturer. The safe operating period used as a basis shall be documented and included in the user information (see Clause 8).

Stage elevators, wagons or turntables at rest may be designed for loads 1,5 times the ELL/R. This shall not give rise to permanent deformation or failure of the component.

To account for failure conditions, all drive system components between the load carrying device and load securing devices shall be designed such that 1 time the exceptional load shall not give rise to permanent deformation or failure of the component.

Load securing devices can also act as load holding devices.

5.4.2 Load securing devices

This can be achieved by means of for example movement-operated load securing (dynamic self-sustaining), or at least two independently functioning load securing devices.

An example of a movement-operated load securing device may be a dynamically self-sustaining gear box; an independent functioning load securing device may be brakes which function independently in all operating modes.

The load securing devices shall be capable of bringing the test load to rest, even if one of them fails. For design of load securing devices, ensure the stopping time and resultant over-speed does not compromise the effectiveness of the load securing devices.

It shall be possible to check the effectiveness of each load securing device separately when operating at rated speed.

Delayed engagement of a second brake is acceptable if proven by a risk assessment; this shall be considered when calculating the stopping distance in case of failure.

Where a control circuit failure may result in loss of delayed brake engagement, this shall be taken into account during the calculation of the exceptional load and stopping distance.

If brakes are used, the braking and clamping forces may only be generated by means of weight forces or guided compression springs. In the event of a compression spring breaking, coils of springs shall not become twisted within each other.

Where multiple brakes (including hydraulic drive systems, valves or clamps) are used these shall be engaged by means of at least two independent devices. These can be the same as the devices used to shut-off the system.

The risk assessment may demonstrate that one load securing device is sufficient.

For horizontal movements (e.g. stage wagons, revolving stages, curtain systems etc.) the machine design and intended use may not require the use of two load securing devices. If the risk assessment shows that two securing devices are not necessary and they may introduce additional hazards, then an alternative means of preventing unintentional movement may be used. This may involve the use of one or no independent load securing devices. However, this can only be the case when one load is being moved by a group of several drive systems and when one drive system fails, the other systems are capable of safely holding the load.

If risk assessment shows that one securing device is sufficient for achieving the required safety for horizontal movements (e.g. stage wagons, revolving stages, curtain systems, chassis) one securing device may be sufficient even with only one drive system.

5.4.3 Couplings

Couplings in the flow of driving forces shall be constructed so that in case of a failure of plastic or rubber parts there is a positive engagement by metal parts.

Friction couplings and switchable couplings of lifting devices (e.g. pole face and electromagnetic tooth clutches) may only be used if load securing devices are arranged on the load side. The friction coupling shall be designed in such a way that it does not slip under double the characteristic load or 1,5 × the exceptional load, whichever is greater.

Where failure of a coupling (e.g. shaft collars) may lead to a hazardous situation the effectiveness of the coupling shall be monitored.

5.4.4 Direct Acting Rated Capacity Limiters

Direct acting rated capacity limiters (e.g. friction clutch, slipping clutch, adjustable torque limiters) lying in the kinetic chain between the load and the load securing devices are not admissible for lifting machinery.

If the direct acting rated capacity limiter is located between the power source and the load securing device, the limiter shall be set higher than 1,25 x the ELL, provided such setting is not creating a hazardous situation. If the operation of the limiter creates a hazardous situation, it shall be monitored.

5.4.5 Screw jack systems (spindle drives)

On screw gears of lifting devices, the support nut shall be designed for twice the characteristic load. The wear of the support nut shall be monitored by a device. The permissible wear is specified in such a way that a residual load capacity of 1,6 times the characteristic load shall be preserved. If a safety nut is arranged in addition to the support nut, it is sufficient to design both nuts for 1 × the characteristic load. The wear of the supporting nut shall be monitored by means of a wear measuring device, e.g. a backup safety nut (a non-load bearing rotary nut used to track the wear of the supporting nut). The spindle shall be more resistant to wear than the support nut.

Screw Jacks with ball screw nuts or planetary spindles do not need a wear measuring device.

In the case of stage elevator platforms with a maximum lifting height of 400 mm, the wear measuring device may be dispensed if the permissible wear can be established visually, although in this case, the supporting nut shall still be designed to accommodate a load twice the characteristic load.

5.4.6 Hydraulic systems

Components of hydraulic systems shall be designed using twice the characteristic load pressure for calculations.

Cylinder and pressure pipelines shall be designed for predominantly non-cyclic loads as in EN 13480‑3.

Compression or flared joints, joints using a conical ring fitting, and other similar joints, as well as hose assemblies, may not be used between a hydraulic drive system and load securing device. Non-cutting compression joints may be used.

In the case of commercially available components, e.g. pipe connections or valves, which are placed between the hydraulic actuator and the load securing device, the nominal pressure as stated by the manufacturer shall be at least twice the value of the characteristic load pressure.

For the rest of the hydraulic system, calculations shall be based on the un-factored operating pressure when designing components between the load securing device and the pressure generating equipment.

The operating pressure shall be limited by means of a pressure limiting device. It shall be possible to measure the operating pressure.

A rupture of a hose or tube shall be detected.

Hydraulic drives shall in general be provided with local manual isolating valves with which the drive can be cut off from the rest of the system.

If the pressure is generated by means of a gaseous cushion which has a direct influence on the hydraulic fluid, all drive systems shall automatically switch off once the fluid reserve or the operating pressure goes below the minimum level.

5.4.7 Auxiliary drive systems

When a hand crank or auxiliary drive equipment is engaged, the power drive shall be automatically interrupted. The direction of travel of the auxiliary drive system shall be clearly indicated.

5.4.8 Manually powered systems

Manually powered systems shall be designed so that a load over the ELL is notified to the user by visual and/or acoustic indicators which should be clearly identified. The overload indicator system should have a tolerance in accuracy of 20 % of the ELL and it shall be designed to work under 2 times the Characteristic Load.

If the overload indicator system needs electrical power to work, then the drive mechanism shall be unusable in case the overload indicator system has a power failure.

The requirement of overload indication is also considered to be satisfied if considerable effort is required for lifting, e.g. if manual forces acting on the farthest end of the crank exceed 150 N.

Manually powered counterweight hoists shall have a load holding device which can withstand 2 × the manual force applied by a person in any direction (400 N). This device may be located on the line being handled by the operator.

With regards to diverter pulleys for the operator’s line the bottom of the rope groove shall be a circular arc.

The groove radius shall be nominally 20 % larger than the nominal rope radius. Grooves shall be smooth with radiused/chamfered edges.

Pulley pitch circle diameter for fibre rope should be a minimum of 8 times the rope diameter.

Operator line forces should not exceed 200 N.

Examples of manually powered systems are given in Figure 7.

5.4.9 Manual performer flying systems

General

Requirements as listed in 5.6.7 will not apply to manual performer flying systems.

Fibre ropes for manual performer flying systems

Synthetic fibre ropes used as load bearing lines shall meet the requirements for a safety factor of at least of 14 at characteristic load where the safety factor is the quotient of the minimum breaking load and the partial tensile force acting at characteristic load.

Natural fibre ropes on load bearing lines may be only used instead of synthetic fibre ropes if a risk assessment indicates it is safe to do so.

Load bearing lines with a single strand construction like 1x19 cable, shall not be used with blocks and pulleys.

Terminations shall be such that at least 80 % of the rope’s minimum breaking force is maintained.

Operator lines and travel ropes

Operator lines shall have a minimum design factor of 14, based on the weakening in the end-connection such as knots or splice. The rope should be made of synthetic fibre.

When the travel rope is made of synthetic fibre, it shall have a minimum safety factor of 5.

Natural fibre ropes for operating lines may be only used instead of synthetic fibre ropes if a risk assessment indicates it is safe to do so.

Pulleys, block-systems, sheaves and drums

For travel ropes the D : d ratio shall have a minimum value of 8.

Design measures shall ensure that the fleet angle of the rope from the pulleys, blocks, sheaves, or drums, even when it is under swinging load or slack, shall never exceed 2° on either side.

Pulleys and blocks shall be designed in such a manner as to prevent the cable from coming out of the groove of the sheave.

Track systems and trolleys

The design of track systems and trolleys shall follow the requirements of Clause 5.

Track sections shall be secured and joined together by bolts, welds, or clamps that will prevent sections of the track from separating during use.

Ends of track systems shall be provided with reliable end stops, which prevent a trolley coming off its track.

Trolleys shall be designed to prevent twisting on the horizontal or vertical axis, and captive on the track.

Key

1	pulley	6	counterweight
2	fly bar	7	rope lock
3	pulley and head block	8	line collector
4	loading galleries	9	winch
5	operator’s line

Figure 7 — Examples of manually powered systems

5.4.10 Load holding devices for stage elevators

Stage elevators attached to ropes or chains or driven by hydraulic cylinders should be equipped with positive load holding devices for preferential positions, to avoid changes of their exact position or oscillations under different load conditions.

Such load holding devices may be omitted if one of the following conditions is met:

— stage elevators are not used as part of the stage floor, for instance trap mechanism for persons

— the stage elevator is designed for the same load as the rest of the stage and a level adjustment control system is installed

Additional positive load holding devices should be avoided when spindles, toothed racks, lantern gear devices, self-erecting spindles or pushing chains are used as direct drives.

In the case of direct-acting hydraulic cylinders, positive holding devices may be replaced by friction load holding devices.

5.5 Load carrying devices

Load carrying devices shall be calculated for 1 times the characteristic load or the exceptional load whichever is greater.

The deflection of the load carrying device should be taken into account or excitation of the floor shall be taken into account. The maximum deflection shall be defined.

Hoist bars or lifting beams shall be dimensioned so that the calculated deflection between two suspension points due to the ELL is not greater than 1/200 of the length between the two points under any allowable load conditions.

The load carrying device of a point hoist (e.g. the hook) shall be calculated for twice the characteristic load or the exceptional load, whichever is greater.

All wire ropes supporting a load carrying device with more than one suspension point shall be provided with a device for length compensation.

All structural elements of load carrying devices shall be made of non-flammable materials. This requirement does not apply to platform floor coverings.

NOTE For design of trusses, refer to EN 17115.

All guided power-driven suspended load carrying devices shall have a component which interrupts their movement when the suspension system becomes slack.

6.0 Safeguarding hazardous areas

6.1 Protective spaces for inspection and maintenance

Where it is necessary to carry out inspection and maintenance work underneath the machinery installation protective spaces shall be provided (e.g. underneath a stage elevator). It shall be possible to lower stage elevators only so far so as to allow for a protective space to be formed underneath the entire platform area. The vertical distance from the lowest point of the elevator platform shall be at least 0,8 m to the bottom of the protective space, 0,5 m to any permanent constructions, disregarding limit stops, above or below the space, 0,12 m between the elevator apron and the bottom of the protective space. The vertical distance below the lowest point of the guiding system may be disregarded, as long as the protective space has a floor area of at least 0,8 m × 1,5 m.

The protective space may be temporarily formed. To achieve this, a blocking device shall be fitted to allow maintenance and repair work to be safely carried out below the platform. This device shall be capable of supporting the weight of the load carrying device and of being operated or installed by one person from a safe position. The safe position may be achieved by using functional load securing devices.

The blocking device shall be easily accessible and permanently fitted to the equipment or installation, or stowed close to the equipment where space does not permit permanent installation.

It shall not be possible to remove the blocking device unless the platform is supported by the lifting mechanism or by other means.

For powered blocking devices, it is required to clearly indicate that the blocking device is correctly positioned. (Refer to EN 1570‑2.)

Access openings to protective spaces shall be at least 0,6 m × 0,8 m.

6.1.1 Accessibility of maintenance areas

Walkways between drive systems and control gear/switchgear which are used during maintenance work or when monitoring machinery operations should be at least 0,6 m wide and have a clearance height of at least 2 m.

Where the distance between the bottom of a protective space and the highest operating position of a stage elevator platform is no greater than 3 m, the space may be entered through the elevator platform.

Access flaps in the stage floor at positions of drive systems or control gear/switchgear shall have a clearance of at least 0,6 m × 0,8 m and open upwards or be removable. It shall be possible to open the flaps into a stable position, or they shall be provided with an automatic hold-open device. Guards against falls and access aids shall be provided and readily accessible. Floor flaps shall be secured against unintentional lifting. Access flaps at positions of drive systems or control gear/switchgear can have a smaller clearance provided they are not allowing people to enter the machinery.

Maintenance walkways shall be clearly and permanently identified by means of a sign saying “Maintenance access – Authorized personnel only” or an appropriate localized version.

6.1.2 Safeguarding at crushing, shearing and trapping points, and fall protection

Crushing, shearing and trapping points are to be avoided. Where such points are unavoidable, they shall be safeguarded by means of fixed guard or protective devices as defined in EN ISO 12100.

Such devices include, for example (pressure) sensitive edges, light beams, light curtains.

If the use of guards or protective devices is not practicable, protective measures shall be defined including clearance, complete view to the travel area and hold-to-run control devices.

Gaps in the stage floor due to moving elements such as stage elevators may not be wider than 20 mm. If operating conditions make wider gaps necessary, the manufacturer shall provide suitable and sufficient protective means.

If heights from which a person can fall are unavoidable within the travel range of stage machinery (e.g. a stage elevator), then protective measures shall be provided.

For artistic reasons it may not be possible to provide guarding or other physical measures to prevent falls. In this case the risk of falling shall be addressed by suitable and sufficient additional protective measures.

6.1.3 Elevator shaft walls, openings and landing doors

6.1.4 General

If stage machinery (e.g. a stage elevator) moves along a wall, any openings in such walls shall have suitable elevator landing doors, the clearance height of which shall be at least 2,0 m.

Elevator shaft walls and doors shall be even and smooth on the inside of the shaft. The distance to the elevator platform installation shall be no greater than 20 mm unless this gap is protected by some other means permanently fitted to the equipment.

On the shaft side, doors shall be flush when closed. Crushing or shearing points at projections or recesses near sliding doors shall be avoided or safeguarded.

Doors along escape routes shall open in the direction of escape and shall not project into the shaft.

Designers should take account of the large volume of air being displaced during motion of platforms, e.g., consider air escape paths or providing air ventilation systems.

6.1.5 Interlocking of doors

It shall not be possible for the machinery (e.g. stage elevator) to start until all elevator shaft doors are closed and locked.

Door locks should be provided with a monitored safety device in accordance with the risk assessment.

It shall only be possible to open elevator shaft doors when the elevator is stationary and the vertical distance between the platform and the access landing is no greater than 0,2 m.

Door locks shall be designed so that the interlock cannot engage when the door is not closed.

See 7.3.4.17.

6.2 Counterweights

Counterweight cradles shall be designed to prevent weights from falling out, including in the case of hard impacts at the stop.

The use of mechanical springs instead of counterweights is not permitted.

Tracks of counterweight systems shall have protective covers. With variable counterweights the protective cover may be interrupted in the necessary working areas up to a height of 2,30 m. At these positions, a baseboard of at least 0,2 m, a knee rail and a hand rail shall be installed. The height of the handrail may be reduced during the working process.

If working galleries are used for storing counterweight elements a baseboard of at least 0,4 m shall be installed in addition to rails at the stage side.

Where counterweights travel in work areas and traffic areas and access to these counterweights is not necessary, suitable guarding shall be provided to ensure that any falling counterweight is contained and safety distances as in EN ISO 13857 and EN ISO 13854 shall be maintained.

If loading and unloading of the counterweight is necessary, these operations have to be possible without entering the hazard zone (for example by suppressing manual handling).

If protection cannot be achieved with inherently safe design, additional protective measures shall be defined to avoid risks due to movement or falling of counterweights.

7.0 Electrical equipment and control systems

7.1 General requirements

7.1.1 General

When designing and installing electrical and electronic systems, including any safety components, of machinery installations as in this document, the following standards shall be used:

— EN 60204‑1 or EN 60204‑32, especially in regards to:

— selection of equipment;

— electrical supply;

— physical environment and operation conditions;

— incoming supply conductor terminations;

— terminal for connection to the external protective earthing system;

— supply disconnecting (isolating) devices;

— devices for switching off for prevention of unexpected start-up;

— devices for disconnecting electrical equipment;

— protection against unauthorized, inadvertent and/or mistaken connection;

— protection against phase failure or wrong phase sequence;

— equipotential bonding;

— control circuits and control functions;

— control and enabling devices;

— cable-less control devices;

— safety functions and control functions in the event of failure;

— start and stop devices and indicators;

— devices for emergency switching off;

— conductors and cables;

— wiring practice;

— electric motors and associated equipment;

— accessories and lighting;

— technical documentation for electrical equipment.

— the EN 61508 series, EN 62061 or EN ISO 13849‑1 and EN ISO 13849‑2 for functional safety related topics.

NOTE 1 For fundamental health and safety requirements, see the applicable European directives.

NOTE 2 In this document the term “electrical” includes both electrical and electronic matters (i.e. “electrical equipment” means both the electrical and the electronic equipment). The equipment covered by this document commences at the point of connection of the power supply to the machine.

When installing the power supply system, including the electrical control system, and when selecting electrical equipment, steps shall be taken to ensure that hazardous operating conditions are prevented in the event of failure.

Risks due to hazards associated with the electrical equipment shall be considered when carrying out a risk assessment of the machinery installation.

Where failures or disturbances in the electrical equipment can cause a hazardous situation or damage to the machine or to the load, measures shall be taken to minimize the probability of the occurrence of such failures or disturbances. The required measures and the extent to which they are implemented, either individually or in combination, depends on the level of risk associated with the respective application.

The electrical control circuits shall have an appropriate level of safety performance that has been determined from the risk assessment at the machine in accordance with the requirements of EN 62061 and/or EN ISO 13849‑1.

By selecting suitable safety measures for the required SIL or PL_r when designing electrical equipment, the necessary protective measures and acceptable level of risk for persons exposed to the relevant hazards can be determined.

7.1.2 Selection of equipment

Electrical equipment may include but is not limited to: materials, fittings, devices, components, appliances, fixtures and apparatus that form part of the machine.

7.1.3 Physical environment and operation conditions

Electromagnetic compatibility (EMC)

The electrical/electronic equipment shall not exceed the limits for EMC emission specified in EN IEC 61000‑6‑4 and shall meet the requirements for EMC immunity specified in EN IEC 61000‑6‑2:

a) methods of measurement and limits are specified in EN IEC 61000‑6‑4 for EMC emissions and in EN IEC 61000‑6‑2 for EMC immunity;

b) the user is to be informed of any special measures needed to fulfil the above-mentioned requirements (e.g. use of shielded or special cables);

c) equipment intended to perform safety related functions shall comply to EN 61326‑3‑1.

Ambient air temperature and humidity

All electrical equipment shall be designed and chosen to operate correctly in the expected environmental conditions. Harmful effects (e.g. of condensation in control cabinets) shall be avoided by the provision of heaters and air conditioners.

7.2 Incoming supply conductor terminations and devices for disconnecting and switching off

7.2.1 Electric motors and associated equipment

Electric motors shall meet the requirements of EN 60034‑1.

7.2.2 Protection against electric shock

Persons shall be protected against electric shock:

a) under normal conditions (basic protection);

b) under single-fault conditions (fault protection).

Additional protection may be specified as part of the measures taken under specific conditions as protection against external influences and in special areas of application. EN 60204‑32 describes recommended protective measures.

7.2.3 Protection of equipment

General

Recommended design criteria for safety devices are described in EN 60204‑32. According to EN 60204‑32, where applicable the equipment is to be protected against the effects of:

a) overcurrent arising from a short circuit;

b) overload current;

c) abnormal temperature;

d) loss of or reduction in the supply voltage;

e) over speed of motors;

f) earth fault;

g) incorrect phase sequence;

h) over-voltage due to lightning and switching surges.

If one of the above malfunctions causes the operation of a protective device resulting in the stopping of a machine, an automatic restart shall be prevented.

Protection under fault conditions

A fault in the electrical equipment shall not lead to a hazardous condition. Suitable measures shall be taken to prevent such conditions, by e.g. providing additional safety-related control circuits.

When a fault occurs, safety-related control circuits shall restore safe conditions.

Cutting off power

When necessary to cease force or torque at the drive system the power to the drive system shall be cut off safely.

Suitable measures for power cut-off include the following measures:

a) providing contactors between the power supply and drive system (mains isolation);

b) providing safety valves between the power source and the drive system (fluid power isolation);

c) providing contactors between the drive system and the drive motor (motor isolation);

d) safely blocking the control pulse of the semiconductor device within the drive system.

NOTE Safely blocking the control pulse of the semiconductor device is not the same as isolating the electrical supply.

7.2.4 Control circuits and control functions

General

In general, control circuits and control functions for machinery installations shall be selected in accordance with EN 60204‑32.

Control devices

All motion shall be initiated and ended by means of a control device, with the direction of movement being clearly indicated to the operator. If it is possible to initiate contrary movements concurrently, this function shall be clearly indicated. The movement shall continue only as long as the operator is actively enabling the control device (e.g. by means of a “deadman” device). ‘Motion’ may include programmed delayed machine starts or automatically triggered initiation of other motion.

Control devices shall be protected against unintentional actuation (e.g. by means of protective shrouds or blocking devices) and unauthorized actuation (e.g. by means of key-operated switches).

Control devices shall be located so that the operator or operators can safely monitor the operating zones from the operating position(s). Alternatively, an enabling device may be included to ensure safe monitoring.

Where a system has multiple control stations, interlocks (hardware or software) shall prevent the simultaneous control of a machine or group of machines by more than one control device.

The control system shall be so designed that no operation shall cause unintended motion.

NOTE The emergency stop function cannot be considered as a means of prevention of unexpected start up as described in EN ISO 12100.

It shall be possible to reset the control system after an incorrect sequence of controls has been selected.

Enabling devices

An enabling device may be necessary, for instance, when it is not possible to monitor the machine’s movements from the operator’s position.

The functional definition and design features of enabling devices are specified in detail in EN 60204‑32.

Cable-less control devices

Cable-less controls may be used if they meet the same safety requirements as the rest of the installation. They shall also meet the relevant requirements specified in EN 60204‑32 and EN ISO 13850.

7.2.5 Travel of groups of machines

General

Machines may be controlled together by an operator to form a group of machines. In this case the action of the group upon an error condition will depend upon the type of group operation. There are 3 possible types of group operation:

a) asynchronous travel without group deactivation: In the case of asynchronous travel without group deactivation, the relevant machine shall come to a stop when the initial limit is reached or when a relevant safety function is activated;

b) asynchronous travel with group deactivation: In the case of asynchronous travel with group deactivation, the entire group shall come to a stop when a relevant safety function is activated. The system shall easily identify which machine has caused the error condition;

c) synchronous travel of a group of machines: Synchronous travel is when all of the machines in a group travel interdependently (route- or time-synchronized travel) and shall be monitored e.g. when several machines are used to lift a common load. The group shall be stopped when a relevant safety function is activated. When a safety function is activated, the permissible group synchronization tolerance in the event of failure may not be exceeded. The system shall readily identify which machine has caused the error condition.

Travel of several groups

Where several groups and/or single installations travel simultaneously and are controlled by a single control device, the travel modes of the various groups/installations shall be maintained.

7.3 Safety functions and control functions in the event of failure

7.3.1 General

Safety functions are measures which either eliminate hazards or reduce the risks associated with hazards by changing the design or operating characteristics of the machine without the use of guards or protective devices.

These are functions of the machine whose failure can result in an immediate increase of the risk(s).

The implementation of inherently safe design safety functions should be preferred to complementary safety measures or information for use.

Organizational measures should not be used as primary risk reduction protective measure.

Safety functions for an E/E/PES shall be selected on the basis of a risk assessment and implemented according to EN 61508 series, EN 62021 or EN ISO 13849‑1 and EN ISO 13849‑2.

Where the supplier of the E/E/PES is not responsible for designing the entire system (E/E/PES and drive equipment), the system developer shall specify the functional safety requirements for the E/E/PES based on risk assessment carried out in accordance with EN ISO 13849‑1, EN 62061 or the EN 61508 series of standards.

Annex C contains guidance on safety functions for specific use cases. Functions integrated into the E/E/PES may also serve as safety functions. The safety functions performed by the E/E/PES shall be determined to mitigate the hazards identified in the risk assessment process and may include the following and or other functions for example:

a) stop functions;

b) emergency stop functions;

c) start functions;

d) speed limits;

e) protection against overloading and underloading;

f) position limits;

g) protection against speed deviation;

h) exceeding specified tolerance limits in the case of group synchronous travel;

i) deviations from specified trajectories;

j) over-travel;

k) acoustic signals;

l) override functions;

m) group synchronization and monitoring functions.

General requirements for control functions in the event of failure are described in detail in EN 60204‑32.

Where faults or disturbances in the electrical equipment can result in a hazardous condition or damage to the machinery, suitable measures shall be taken to minimize the probability of such hazards occurring. The required measures and the extent to which they are to be implemented, either individually or in combination, will depend on the level of risk associated with the respective application.

Measures to minimize risk and risk reduction in the event of failure are also described in EN 60204‑32.

7.3.2 Providing redundancy

By providing partial or complete redundancy, it is possible to minimize the probability that a single fault in the electrical circuit can result in a hazardous condition.

Unless a single channel system can be proved to meet the required SIL/PL_r, redundancy is to be designed-in for switching devices (e.g. contactors, relays, valves) in safety devices, and such devices are to be monitored separately. Redundancy is also to be provided for any contactor relays (intermediate relays) in safety circuits (that is, if a fault in such a relay could disable a safety function).

7.3.3 Hazardous operating conditions

Faults in the installation shall not lead to hazardous operating conditions. Such conditions exist, for example, when:

a) the prescribed speed is exceeded;

b) the barriers or door closures on stage elevator doors are not engaged;

c) load bearing lines become overloaded or slacken;

d) the wear limit of spindle drives is reached;

e) the floor of a stage elevator exceeds travel limits;

f) the permissible group synchronization tolerance is exceeded;

g) the prescribed trajectories are not maintained.

Faults in the control or regulating system shall not hinder stopping.

7.3.4 Safety devices and safety functions

General

The technical measures needed to perform these functions will depend on their functioning under failure conditions within the E/E/PES, and are to be selected on the basis of risk assessment.

If a safety function is triggered, the machine shall go to a safe state (e.g. stop). Further motion that removes the hazard may be permitted.

It shall be possible to check the functioning of all safety devices.

The activation of a safety device shall be indicated as long as the activation is in effect.

Attention shall be paid to the mechanical connection between the machine and the safety related sensors; any single failure of the mechanical connection shall not lead to danger.

Safety circuits which register the exceeding of specified travel paths, speeds, loads, or unacceptable deviations from specified trajectories, which could cause a hazardous condition shall initiate a safe stop when activated. The stop category shall be established on the basis of risk assessment for the machinery installation in question.

Limitation of travel

Where over-travel will result in a hazardous condition then two sets of limit switches shall be fitted, an ‘initial’ and an ‘ultimate’ limit switch. (This does not apply where the over-travel of a hydraulic cylinder is limited by means of fixed, damped limit stops, and a shut-off is ensured by additional means, such as a pressure switch.)

The ‘initial’ limit switch shall be a mechanical limit switch connected to the electrical system in such a manner as to prevent further movement in the over travel direction. It shall allow the user to operate the system in the opposite direction.

The ‘ultimate’ limit switch shall be a positive break mechanical limit switch, which immediately removes power to the motor, and brake. Optionally the stop function of an ultimate limit switch can implement a category 1 stop. In this case special note should be taken of the following paragraph.

Ultimate limit switches shall be located in such a manner that should the initial limit fail to operate, and the machinery strikes the ultimate limit at maximum speed, taking the system reaction time into consideration, the machinery installation shall come to a stop safely before the over-travel results in a hazardous condition.

Where the machine can be re-configured after the initial installation, it shall be possible to set ‘initial’ and ‘ultimate’ limit switches for the relevant travel range. The modification of machinery installations, including the resetting of initial and ultimate limit switches, may only be carried out by trained, authorized persons.

Over-travel limit switches shall be designed in accordance to EN 60947‑5‑1.

As an alternative to limit switches the control system may use a suitable position sensor(s) with equivalent SIL/PL levels and safety related E/E/PES to implement the initial and or ultimate travel limits of the system. The position sensor shall remain active in all normal operating modes including maintenance.

Providing protection when characteristic loads are exceeded (Overload Protection)

The machinery movement shall stop when the load exceeds 1,2 times the ELL.

Elevators and accessible lighting bridges shall not be permitted to move in an overloaded condition.

Upper machinery shall stop when the load is exceeded, the system may allow the operator to move the machinery in a direction so as to lower or reduce the load where it is safe to do so.

A direct acting lifting force limiter shall not be used to provide protection against overload.

NOTE See 5.6.4 for direct acting capacity limiters requirements.

Providing protection in underload or slack conditions

In machinery installations where underload or slack conditions can lead to a hazardous situation, (e.g. due to slackening of lines) the movement shall be stopped in the event of an underload or slack condition.

Elevators shall only be permitted to move in a contrary direction in an underload or a slack condition where the machine design specifically allows this.

Upper machinery shall be stopped when the underload or slack condition is detected. The system may allow the operator to move the machinery in a direction so as to clear the underload or slack condition where it is safe to do so.

Providing protection against improper winding

In machinery installations where improper winding can lead to a hazardous situation (e.g. due to a crossed groove or rope doubling), the movement shall be stopped.

Providing protection when wear limits of screw jacks are reached

The machinery installation shall stop when the wear limit is reached.

Protection against speed deviation

Speed regulator functions of machinery installations shall be capable of automatically identifying unallowable deviations in speed which could cause a hazardous condition. In this case the machine shall be brought to a stop.

Protection against over-speed

The control system shall initiate a category 0 stop when the operating speed exceeds 1,25 times the rated speed of the machine.

Providing protection against brake failure

Where brakes are used as a safety device, suitable measures shall ensure that the brakes are not damaged, e.g. by monitoring air gaps or automated testing. Protection against brake failure may be achieved through regular inspection where this can be demonstrated to meet the required SIL/PL_r.

Protection against power source failure

Where a supply interruption, voltage reduction or reduction in fluid pressure can cause a hazardous condition, undervoltage or low pressure protection shall be provided (for example, by switching off the machine and/or engaging the load securing device) at a predetermined voltage or pressure level.

Depending on the risk assessment, undervoltage or low pressure protection may be omitted on a manually controlled machine.

See EN 60204‑32.

Protection against structural overload

Where the total load applied to a number of machines in an installation can lead to damage or failure of the supporting structure, an overload detection shall be implemented in the support structure or the maximum lifting capacity of the machinery installation shall be limited in the control system.

In order to prevent dynamic overload to the support structure, the control system shall limit the forces applied to the structure, (e.g. by measuring the attached loads and limiting the number of axes to a maximum resulting moving load).

Providing protection against drive transmission failure

If the risk assessment shows risks not covered by 5.6, a system shall be implemented that stops the machine when the integrity of the drive transmission is jeopardized.

Providing protection against crushing and shearing

When a safety device preventing crushing or shearing is activated, the machine shall stop and the system shall allow the operator to move the machinery in a direction so as to remove the hazard.

Prevention of hazardous collision with other machines

Where a machine, not the load, shares its motion path with other machines, the control system shall ensure that no hazardous situation is created due to a collision with another machine.

In circumstances where machines are controlled by multiple control systems, or by a combination of automatic and manual control, other protective measures may be necessary to avoid the hazard.

For example:

— elevator systems that are built up from several stacked but independently moveable platforms;

— elevators that form part of the horizontal moving range of stage wagons (stage floor);

— stage wagons that can move on top of or across stage elevators;

— guided stage wagons that can move through the moving area of another stage wagon;

— guided tracking systems that can travel through the moving area of other stage machinery;

— upper machinery rotators whose loads may collide in motion with adjacent machinery or equipment;

— fly bars moving above lifts.

If the load characteristics are likely predictable from the designer, the control system shall be able to ensure that no hazardous situation is created due to a collision with another machine and its load.

Protection against incorrect positions of machines

Where incorrect positioning of machines prior to motion can lead to a hazardous situation, the control system shall ensure that the machine motion is prevented.

In circumstances where machines are controlled by multiple control systems, or by a combination of automatic and manual control, other protective measures may be necessary to avoid the hazard.

For example:

— a stage elevator shall only be allowed to move up/down from floor level if either no wagon is on top of the elevator at all or the wagon is at its full extent on top and secured from falling off the elevator;

— adjacent elevators may be allowed to move in a synchronous group if a wagon is on top of both at a time. Several interlocked wagons may be treated similarly to a large single wagon in this scope;

— a stage wagon shall only be allowed to move onto an elevator or off an elevator if the elevator is stopped at an appropriate floor level.

— a video tracking system shall only be allowed to travel on stage if fly bars or load carrying devices are not in collision position with the tracking equipment.

Protection against moving into open pit areas

Where a machine is moving horizontally on top of (re)moveable stage surfaces (i.e. stage elevators), the control system shall ensure that the machine is stopped before reaching the edge of the open floor area (e.g. stage wagons that can move on top of or across stage elevators).

Protection against creating a hazardous zone

Where the temporary installation of a guard or barrier is necessary to protect people from falling into an open pit area, the elevator or other machine creating this pit may only move more than 0,4 m below the surrounding floor level once the guard or barrier is in place.

Where the temporary installation of a guard or barrier is necessary to protect people from accessing areas hazardous due to moving machines, the motion of any machines in the hazardous area shall be stopped if the guard or barrier is not in place.

Following a risk assessment in accordance with EN ISO 12100, automatic or manually deployed guards or barriers may be required. It may also be necessary to interlock the barriers or guards with the safety related E/E/PES. Due to the nature of artistic performances, the abovementioned safety functions may not apply during the artistic performance or rehearsals and may therefore be temporarily muted or be absent.

Protection against dangerous door access

Where a door is installed to provide guarding of a moving area or preventing people from falling, the door shall be safely locked in the closed position by the control system if the machine is moving or the platform position would create the risk of falling (platform position is ± 0,2 m from the relevant floor level).

If the door is not closed or not locked, the motion of any machine in the guarded area shall be stopped.

The door lock design shall consider the possible conflict with blocking an emergency escape path. The door locking mechanism may provide manual or automatic release in the event of an emergency condition.

Protection against loss of group synchronization

Where a number of machines travel interdependently and the loss of route or time synchronization could result in an increase of risk, the control system shall stop all of the machines in the group when permissible group synchronization tolerances are exceeded.

It shall be possible to identify which machine caused the group of machines to stop.

Group synchronization tolerances shall be listed as in the End User Information in Annex D, Table D.1.

Protection against position deviation

The movement of a machine shall be stopped when the allowable deviation in position from the intended travel path, or the specified target is exceeded.

7.3.5 Means for testing safety devices and safety functions

General

Where safety devices and safety functions are not designed to be intrinsically safe or self-monitoring, means shall be provided to test these safety devices or functions, including but not limited to the following:

a) means to prove the effectiveness of each load securing device;

b) means to prove the effectiveness of the limitation of travel;

c) means to temporarily override the load limitation in order to test load securing device(s).

If it is necessary to override safety function(s) to provide a means to test safety devices or safety functions such overrides shall be designed with due consideration of foreseeable misuse. When test or override modes are active, only control operations required for testing shall be possible.

It shall be possible to check the effectiveness of each safety device individually.

Muting (override) of safety functions

Temporary overriding (muting) of a safety function is only allowed for testing purposes or special scenic situations.

Muting shall not result in any person being exposed to hazardous situations. During muting, safe conditions shall be provided by other means.

Additional measures shall be taken to ensure the override measures are removed after a predetermined period. The override shall also be removed after restart of the control system or change of the user.

An indication of muting is required.

The inclusion of the muting function shall not reduce the safety required of the relevant safety function.

7.4 Emergency stop functions

7.4.1 Emergency stop

Emergency stop systems shall comply with EN ISO 13850.

Machinery installations shall have an emergency stop function which stops the drive system.

The emergency stop system may either implement a Category 0, or a Category 1 stop for the equipment. The choice of category shall be on the basis of a risk assessment and the functional needs of the machine.

NOTE Stop categories are defined in EN 60204-1.

Each operator control station shall be equipped with an emergency stop device unless a risk assessment demonstrates that an emergency stop device in the area of the operator control station is acceptable.

Additional emergency stop actuators shall be located based on the results of a risk assessment.

Emergency stop actuators shall stop all equipment moving in the affected area, including equipment in different installations, unless a risk assessment shows that individual emergency stop systems are acceptable.

7.4.2 Actuators for and design of emergency stop functions

Emergency switching off and stop devices are to be interlocking switches designed in accordance with EN 60204‑1.

Emergency switching off devices shall have a positive break operation.

7.5 Complementary Protective Measures

7.5.1 General

Protective measures which are neither inherently safe design measures, nor safeguarding (implementation of guards and/or protective devices), nor information for use, could have to be implemented as required by the intended use and the reasonably foreseeable misuse of the machine. Such measures include, but are not limited to, those dealt with in 7.5.2 to 7.5.3.

7.5.2 Limitation of number of simultaneous moving machines

Where situations can arise where an operator cannot monitor a definite number of simultaneous moving machines, the system should limit the maximum number of simultaneous moving machines or should provide additional means to ensure the safe operation of the system (e.g. additional enabling device(s) for ‘spotters’).

7.5.3 Protection against unplanned load deviations (load profile monitoring)

Load profile monitoring can be part of the control system to protect against unplanned load deviations.

If the risk assessment shows that sudden load deviations can lead to dangerous situations that cannot be controlled by other means, the control system shall provide means to detect unintended load deviations and shall stop the affected machine at such occurrence.

7.6 Electronic and programmable electronic systems (E/PES)

7.6.1 General

General requirements which apply to all types of electronic control devices are described in EN 60204‑32.

7.6.2 Programmable controllers

Programmable controllers shall fulfil relevant ergonomic and general safety requirements. They shall be designed to prevent unauthorized persons from making changes to the program memory.

7.6.3 Use of programmable electronic systems (E/E/PES) to implement safety functions

Where E/E/PES systems are used to implement safety functions within the control system (or functions that could in the future potentially affect safety), then the SIL according to EN 62061 or the PL according to EN ISO 13849‑1 and EN ISO 13849‑2 shall be determined for each safety function.

7.7 Use of electronic and programmable electronic systems (E/PES) without safety functions

There are no particular requirements for programmable control systems if they do not perform safety-related tasks.

If the programmable control system performs selection functions, the successful selection of a function shall be indicated by means of a feedback signal. The computer shall not have any influence on the effectiveness of the safety device.

7.7.1 Operator interfaces, control devices and contactors

7.7.2 General

General requirements regarding the location and mounting of control devices, as well as their protection against outside influences are given in EN 60204‑32.

7.7.3 Requirements for contactors

The co-ordination of the contactors with the associated short-circuit protective devices shall be a “type 2” coordination as in EN IEC 60947‑4‑1.

Contactors which fulfil the stop function of drive systems and which are controlled by control devices with a safety function shall be selected and combined with other equipment in such a manner that contact welding is either avoided or does not affect the emergency stop function.

7.8 Marking, warning signs and reference designations

Electrical equipment shall be marked with the supplier’s name and the reference designation in accordance with EN 81346‑1.

7.8.1 Testing and validation of electrical systems

7.8.2 General

Tests to verify the characteristics of equipment shall be carried out on all switchgear/controlgear assemblies in accordance with EN IEC 61439‑1 and the results documented. Such tests include:

a) type tests;

b) routine tests.

Type tests are carried out to establish whether the requirements of EN IEC 61439‑1 have been met, and shall be performed by the switchgear/control gear assembly manufacturer.

Routine tests are intended to detect any faults in materials and workmanship. They are to be carried out on every new switchgear/control gear assembly after it has been assembled or on each transport of the unit, by the manufacturer of the assembly.

The performance of the routine tests at the manufacturer’s works does not relieve the installer of the assembly from the duty of checking it after transport and installation.

7.8.3 Scope of routine testing

Continuity of the equipotential bonding circuit shall always be verified.

In addition, the following tests are to be carried out in the order shown:

a) verification that the specification of the electrical equipment agrees with the technical documentation;

b) inspection of the assembly, including inspection of wiring and, if necessary, electrical operation testing;

c) insulation resistance tests;

d) continuity of the earth equipotential bonding protective circuits.

General requirements for testing are described in detail in EN 60204‑32 and EN IEC 61439‑1.

7.9 Validation and verification of functional safety systems

Safety functions shall be validated and verified by the manufacturer and integrator according to EN 61508 series, EN 62061 or EN ISO 13849 series and the results documented.

The manufacturer and integrator shall have a functional safety management system in place.

The manufacturer or integrator shall provide all relevant safety-related information to the end user.

8.0 Documentation

8.1 General

Instructions for use shall be prepared in accordance with EN IEC/IEEE 82079‑1.

8.1.1 Technical data to be included

8.1.2 General

The following data shall be included in the documentation of the machinery installation as far as is applicable:

a) intended use;

b) operating conditions;

c) duty type and operating period of drive system and end of life of safety -related part of the control system;

d) information about action to be taken if components have reached the end of the operating period;

e) ELL and (if applicable) ELL/R;

f) maximum concentrated and area loads;

g) travel speeds;

h) acceleration and deceleration values under normal operating conditions and peak deceleration under exceptional load conditions;

i) fastest deceleration rate (low load with all load securing devices operating at maximum efficiency);

NOTE This is particularly relevant to performer flying.

j) travel path;

k) synchronization tolerances and over-travel limits in all operating modes;

l) tolerances in the event of failure;

m) type of group travel;

n) type of control (for example E/E/PE);

o) independent third-party certification of safety functions and their SIL or PL levels (optional);

p) operating and ambient temperature limits;

q) maximum deflection of elevator platform at ELL;

r) need to protect stage floor gaps wider than 20 mm.

8.1.3 User information for safety functions

The information should, as a minimum, include the information laid out in Table D.1.

8.2 Marking

8.2.1 General

All marking shall be clear, legible and located in a place where it can be easily seen.

Markings shall not significantly reduce the safety or strength of a component.

Markings shall not easily disappear as a result of wear and tear.

8.2.2 Entertainment load limit

Lifting machines shall be marked with their Entertainment Load Limit (ELL) and if applicable also the Entertainment Load Limit at Rest (ELL/R).

Where the ELL may vary depending on the use case (see normative Annex B), the marking shall clearly state the ELL to be applied for each use case.

Machinery that is installed shall be marked with the ELL and if applicable ELL/R near to where the load is attached.

Where the load is applied other than as a single vertical point load, a loading notice shall be provided to indicate the allowable load distribution.

Key

A	maximum concentrated load under one wire rope, depending on rope dimensions
B	maximum concentrated load between two wire ropes, at mid-span, depending on bar dimensions and maximum load A
C	maximum uniformly distributed load between two wire ropes, depending on bar dimensions and maximum load A
D	maximum concentrated load at bar end, depending on bar dimensions and maximum load A

Figure 8 — Loading notice giving maximum allowable loads (example)

Loading notices shall be displayed prominently (see Figure 8).

Typically notices should be provided on the stage/studio floor, on any galleries/gantries, on the grid, adjacent to anchorages and at any control point.

8.2.3 Supplementary loading information

The loading notice shall detail the loading limitations. Detailed design information shall be obtained from the structural engineer responsible for the building and a competent mechanical engineer or the suppliers of the lifting equipment.

Ideally the information should be detailed in both written form and via pictorial representation which should include any terminology specific to the area. For example if there is a maximum load in any one bay (or section) of the grid, then the pictorial representation should show what a bay is.

Where applicable the loading notice shall include at least the following information:

a) where counterweights are stored, the floor loading including the distribution of weights. This shall state the safe point loading in kg and safe distributed loading in kg/m²;

b) maximum ELL for each different type of hoist or counterweight set;

c) details as to whether the load on the bar is allowable as a point load or a uniformly distributed load;

d) the parts of the structure upon which the load may be applied;

e) where the load is permanently installed, and no additional loading is allowed, the total load suspended shall be prominently marked on the load with a notice forbidding any additional loading.

For example, it may be appropriate to paint certain parts of the structure a different colour if loads are permitted. In the converse case if it is not permitted to suspend loads on any general parts of the structure this should be clearly indicated on the loading notice with a suitable disclaimer, e.g. loads may not be applied to any part of the building structure unless painted yellow.

8.2.4 Machinery

Every machine shall carry a “rating label” legibly marked with the following minimum particulars:

a) name and address of manufacturer or importer where relevant;

b) CE mark (where relevant);

c) designation of series or type;

d) serial number;

e) year of construction or manufacture;

f) ELL and (as applicable) ELL/R;

g) intended use of the machine (Use Case, see normative Annex B);

h) relevant EN standard (number of this document);

i) correct power supplies;

j) and where relevant:

1) self-weight;

2) permitted speed range;

3) travel range;

4) control voltage.

8.2.5 Remote operation

All areas where remotely operated machines could start without warning shall be clearly marked with warning signs regarding the hazard.

8.3 Documentation and information

8.3.1 General

The manufacturer shall supply operating instructions upon commissioning, drawing attention to any significant tasks and the corresponding safety measures that are necessary. A separate set of technical instructions shall also be provided giving details of specification, installation, testing, inspections, maintenance, spare parts and dismantling. The manufacturer shall maintain a technical file for ten years from the date of commissioning. Any booklet of more than ten pages shall include a list of contents with page numbers.

If the installation is carried out by the manufacturer, the installation instructions may not need to be issued to the end user.

8.3.2 Operating manual

General

The operating instructions shall contain the following information as a minimum:

a) description of the machinery;

b) an instruction book reference;

c) intended use of the machinery;

d) competency required of the operator;

e) how to operate the controls;

f) how to monitor the operation;

g) any special requirements.

Description

The description of the machinery shall include:

a) make and model, in order to link the instructions effectively to the machinery;

b) address of manufacturer or agents for technical support purposes;

c) repeat of the information with which the machinery is marked, except date of construction, serial number or batch number.

Instruction book reference

The instruction book reference shall contain the manufacturer’s address, identification reference and date of compilation of the instructions.

Use

The operating instructions shall contain details of the intended use of the machinery including normal and other uses that can be foreseen, and details of operations and use which are forbidden.

The manufacturer, importer or distributor shall supply an operator or user instruction manual as in EN ISO 12100 in the official Community language or languages of the Member State in which it is to be used.

The instruction manual shall include the following information:

a) range of applications;

b) information relating to the commissioning of the machine;

c) detailed instructions relating to the use of the machine;

d) circuit diagrams;

e) information relating to the monitoring of safeguards;

f) information relating to maintenance;

g) information as to what to do in emergency situations (i.e. in the event of failure);

h) information as to the acquisition of replacement parts.

The following information may also be included:

i) information as to the intended use of the machine;

j) description of safeguards and other safety devices, e.g. protection against unintentional movement;

k) information on the performance of tests and inspections;

l) testing procedure to check dynamic self-locking device performance.

Operator qualification

Guidance shall be included concerning necessary competence of operators.

Control

A diagram shall be provided showing any control panel with descriptions of functions of all controls. Where controls require sequential operation, this shall be explained.

Vigilance

Instructions shall advise operators to cease operation if there is cause to suspect hazard or malfunction, with guidance concerning the particular machinery and advice to report to maintenance personnel.

Special requirements

Special requirements shall be explained in full, e.g. for high acceleration machinery the dynamic loading effect shall be fully explained considering loads and/or persons to be attached.

8.3.3 Installation Instructions

General

The installation instructions shall include details of the following as a minimum:

a) handling;

b) mounting details;

c) installation;

d) commissioning;

e) installation load testing.

Handling

The instructions shall include the handling procedure for installation, giving the mass of each separate part of the machinery with details of lifting points if critical.

Mounting details

The mounting details shall include:

a) loading imposed at all the mounting points;

b) dimensional layout of mountings and clearances;

c) environmental conditions for which the machinery has been designed.

Installation

The installation procedure shall include warnings of hazards and recommend a sequence of operations to ensure efficient installation. Corrosion avoidance shall be addressed.

Commissioning

The commissioning procedure shall include warnings of hazards and explain a sequence of operations to check that all functions and features operate correctly. Where items have to be adjusted during the commissioning procedure, precise instructions shall be listed in the correct sequence.

Installation load testing

The instructions shall set out recommendations for proof load testing of all systems after commissioning. Relevant regulations can apply to machinery before it can be handed over to operators for normal use (as in 9.3.2.3 and 9.3.2.4).

8.3.4 Repair and maintenance instructions

General

If a wire rope is replaced it shall be replaced by a wire rope of an equivalent construction and specification.

Maintenance work shall only be carried out by those who are adequately trained and competent.

Routine maintenance shall be required to ensure the continued safe condition of the equipment.

The manufacturer shall supply details of the extent of maintenance and its frequency. The manufacturer’s instructions shall take into account that some equipment is used infrequently.

A maintenance log shall be provided.

Repairs, adjustment, lubrication and replacements

Repair procedures shall be sufficiently detailed to determine the permissible extent of repairs and to identify when specialist skills are required.

The limitations for adjustments to wearing parts shall be detailed.

The quantity and quality of lubricants and their means of application shall be specified.

Details shall be included to enable any component to be identified so that spare parts can be requested.

NOTE This does not preclude the use of non-repairable items.

Consumable spares required for routine maintenance shall be listed as such.

Repairs, adjustments and replacement of safety related components

Maintenance of functional safety related components shall be followed by appropriate validation and verification according to the manufacturer’s instructions.

8.3.5 Inspection and examination

Documentation shall be provided to cover thorough examination after installation, including installation at a new site or location, and before being put into service for the first time and shall provide guidance for further inspection.

8.3.6 Dismantling instructions

General

Dismantling procedures shall be described to enable machinery to be removed from site efficiently, and warnings shall be included to guard against foreseeable hazards.

Access

Where specialist access techniques are advisable these shall be described.

Sequence of operations

An efficient sequence of operations shall be recommended.

Protection

Information shall be listed to ensure protection from hazards, damage and deterioration of machinery during handling and storage.

8.3.7 Appendix to instructions (for additional necessary documents)

General

Wiring diagrams and the like shall be listed and included within an appendix.

Wiring diagrams

All wiring diagrams relevant to the machinery shall be included with sufficient detail to enable installation putting into service and fault finding.

Drawings and diagrams

All drawings and diagrams relevant to the instructions that have not been included within the main part of the instructions shall be listed and included.

Optional items

Where optional items have been incorporated with the machinery, and instructions do not cover such items, the relevant instructions shall be included within this appendix.

Test certificates

Copies of all relevant test certificates shall be provided.

9.0 Testing prior to first use and after substantial changes

9.1 General

Prior to first use or after substantial changes, the machinery shall be subjected to testing and shall meet the standards as set out in Clause 9.

NOTE Specific national safety legislation can apply.

If there is any cause for concern with the equipment or if any test fails, corrective measures shall be taken and the inspection and testing process repeated. This process shall be fully documented and copies provided to all parties concerned.

9.1.1 Test log

A test log shall be compiled, comprising the manufacturer’s documentation for the machinery installation and test reports.

9.1.2 Testing prior to first use

9.1.3 Type, extent and performance of tests

General

The test prior to first use comprises the following parts:

a) preliminary test;

b) structural (construction) test;

c) acceptance test;

d) re-verification test (if necessary).

Preliminary test

The preliminary test may include the examination of technical documentation. In general, the following documentation should be available:

a) design documentation presenting the suspension mechanisms in their entirety as well as their individual parts and containing information on load bearing equipment, hoisting accessories, drive mechanisms, counterweights, travel ranges, safety equipment;

b) calculations proving the strength of supporting structural elements, supporting drive, components, load bearing equipment, safety equipment and connections;

c) information on materials, standardized parts and any special manufacturing processes;

d) layout plans, wiring and circuit diagrams as well as program flowcharts for hydraulic, pneumatic, electrical and electronic systems including lists of items, legends and functional descriptions;

e) the examiner may request the submission of further documentation if this is necessary for reasons of safety assessment.

Structural (construction) test

The construction test shall include the following steps:

a) determining whether the equipment is in conformity with the design and manufacturing documentation, for instance with regard to the compliance with material requirements and crucial measurements, the electrical, hydraulic and pneumatic materials employed, the position and arrangement of load bearing equipment and safety equipment;

b) in addition, the required material certificates and those for components such as ropes, chains, pressure hoses and gears shall be provided. For welding operations, the necessary documents proving the welders' qualifications and skills shall be submitted;

c) if proof of a quality management system of the manufacturing company is furnished, the structural test procedure may be restricted.

9.1.4 Acceptance test

General comments

The acceptance test shall be performed on equipment ready to operate. Operating instructions shall be made available. The acceptance test shall assess:

— proper assembly;

— functional sequences by test runs according to the specification;

— functionality and effectiveness of the safety equipment;

— results of test loads;

— completeness of information on necessary characteristics, remarks, safety markings.

Acceptance test for safety equipment

Setting and correct operation of Safety equipment shall be tested, for example:

a) limit switches;

b) locking of stage lifts;

c) safety catches, pipe fracture safety devices, back-up safety nuts for spindle drives;

d) speed limiters;

e) load-limiting devices;

f) pressure-limiting valves;

g) equipment preventing slackening of load bearing equipment;

h) synchronicity-monitoring equipment;

i) emergency control elements;

j) safety circuits;

k) continuous connection of the main protective bonding conductor;

l) interlocking of command elements in case of various control points;

m) control-release equipment;

n) signalling equipment.

Load test of lifting equipment

Load tests shall be carried out with a load of 1,25 ELL/R for loads at rest and 1,10 ELL for loads in normal operation, including the immediate removal of all power sources, on downward travel, at rated speed ensuring the lifting capacity for the test load and the efficient operation of all safety related parts of the machine.

Where a load less than the ELL, or travel in the upward direction, may apply a higher load to the drive system (for example with counterweight drive systems) then the system for the test shall be arranged such that the maximum drive system load is applied during the load test.

For stage elevators with friction-locked load holding devices, test load at rest may be reduced to 1,00 ELL/R.

For stage elevator installations with friction-based holding devices having no self-sustaining mechanism (e.g., brakes), the load tests at rest may be carried out by applying test loads or in a different manner (e.g. torque wrench on the drive, etc.).

For positive holding devices e.g. for hydraulic cylinders resting on seat valves and friction-based holding devices having a locking mechanism, static load tests or equivalent tests with the highest admissible load at rest are not necessary.

Load tests of hoisting equipment are carried out in order to test the hoisting, coupling, braking and holding equipment. The steel structure (e.g. of the stage platform) does not require any load test, a calculated proof is sufficient.

Load test of travelling and turning equipment (particularly stage wagons and revolving stages)

For this equipment load tests are used for testing the drives and brakes. The steel structure does not require any load test, a calculated proof is sufficient. Load tests have to be carried out with payload during travel. For equipment moved by direct manual manipulation (e.g. auxiliary stage trucks) this load test is omitted.

Testing of electrical protection measures

The correct execution of electrical protection measures shall be examined.

Acceptance report and test log

The test results shall be entered into an acceptance report which shall also include figures of the highest test load for each hoisting mechanism. Essential data concerning the installation shall be entered into a test log, to which shall be attached a copy of the acceptance report.

Verification following rectification of defects

The verification following rectification of defects is limited to checking the correction of the defects, as detected by the acceptance test.

9.2 Test after changes and modifications

9.2.1 Substantial Changes

After substantial changes such as modifications and large scale repairs further tests shall be carried out.

These changes include, for example:

a) modifications in the system of travel ranges and their access points;

b) modifications in control systems or SRP/CS;

c) increase in lifting capacity;

d) modifications of drives and brakes;

e) design modifications in supporting parts and load bearing equipment.

Modifications and large-scale repairs are defined as any changes which involve a change to the design of the machine including replacement of parts with those of a different specification.

The replacement by parts of the same specification (such as ropes, hydraulic cylinders, gears, motors, brakes) shall not be regarded as a substantial change. In the case of substantial changes, tests shall be performed in accordance with 9.3.1 before operation resumes. The type and extent of the test shall be determined by the examiner. Substantial changes may require re-evaluation against all applicable essential health and safety requirements.

9.2.2 Any other changes

Tests shall be performed in accordance with 9.3.2 before operation resumes. The type and extent of the test shall be determined by the examiner. In this case it is acceptable to test individual components only.

(informative)

Examples of hazards and risk origin

Table A.1 — Examples of hazards and risk origin

EN ISO 12100			Entertainment Industry
Hazard type	Hazard Origin	Potential Consequences	Risk Origin	Hazardous Event
Mechanical	Acceleration Deceleration	Person(s) run over	Incorrect operation	Tracking system travels to work position, persons stand in travel path.
Mechanical	Acceleration Deceleration	Person(s) run over	Incorrect installation, testing, use and maintenance	Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
Mechanical	Acceleration Deceleration	Crushing	Lack of stability	Incorrect dimensioning of structural elements and components.
			Incorrect loading, overloading, exceeding specified overturning moments	Improper force or load transmission, stability calculations not carried out for exceptional loads.
			Uncontrolled movements	Exceeding specified travel limits.
Mechanical	Approach of a moving element to a fixed part	Crushing	Incorrect installation, testing, use and maintenance	Persons work on machinery which is being operated by a second person unaware of the first.
				Instructions for use are incomplete.
				Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
			Collision of machinery components	Distance between fly bars too small.
			Collision of machinery components	Extended bars collide with batten hoist, leading to a collision and scenery falling.
			Unintentional movement due to mechanical failure	Unintended turning, tilting, hanging, falling, uncontrolled lowering.
			Uncontrolled movements	Uncontrolled speeds.
Mechanical	Approach of a moving element to a fixed part	Cutting or severing	Incorrect Operation	Tracking system travels to work position, persons stand in travel path.
			Unintentional movement due to mechanical failure	Failure of drive system or locking device.
			Incorrect installation, testing, use and maintenance	Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
				Persons work on machinery which is being operated by a second person unaware of the first.
				Instructions for use are incomplete.
Mechanical	Approach of a moving element to a fixed part	Drawing-in or trapping	Uncontrolled movements	Unintentional drive start-up.
Mechanical	Approach of a moving element to a fixed part	Drawing-in or trapping	Drawing-in or trapping	Hazards at winding devices and diverter pulleys. Hazards at lower hook hitting the electric chain hoist body as chain is fed into the chain guide.
Mechanical	Approach of a moving element to a fixed part	Entanglement	Entanglement	Material or pieces of clothing are caught in the tracking system.
Mechanical	Approach of a moving element to a fixed part	Entanglement	Incorrect installation, testing, use and maintenance	Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
Mechanical	Falling objects	Crushing	Incorrect design of machinery parts	Incorrect dimensioning of structural elements and components. Chain hoist load suspensions, (hooks, plates or lugs) are not properly installed.
			Incorrect design of machinery parts	Chain hoist terminations are not secured against self-detachment and they detach.
			Unsuitable design of load carrying devices and rope drums	Rope wear due to incorrectly dimensioned drum grooves.
			Unsuitable design of load carrying devices and rope drums	Rope falls off side of drum.
			Incorrect installation, testing, use and maintenance	Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
			Unsuitable selection of chains and lifting devices, equipment and incorrect integration to machinery	Load chain (presented in side-link way or twisted) jams into the gearbox and snaps releasing the load.
Mechanical	Falling objects	Impact	Incorrect design of machinery parts	Machinery covers, accessories and parts of the enclosure are not properly fixed to the machinery.
Mechanical	Gravity and stability	Crushing	Lack of stability	Incorrect dimensioning of structural elements and components.
				Yielding of support points. Characteristics of the supporting surface, ground conditions, slopes, etc.
				External forces such as wind pressure, snow, etc.
				Seismic forces acting on the machinery structure.
Mechanical	Height from the ground	Person(s) run over	Unintentional movement due to mechanical failure	Unintended turning, tilting, hanging, falling, uncontrolled lowering.
			Uncontrolled movements	Unintentional drive start-up.
			Uncontrolled movements	Exceeding specified travel limits.
Mechanical	Height from the ground	Drawing-in or trapping	Uncontrolled movements	Unintentional drive start-up.
Mechanical	Height from the ground	Slipping, tripping or falling	Incorrect operation	Tracking system travels to work position, persons stand in travel path.
			Uncontrolled movements	Unintentional drive start-up.
			Incorrect installation, testing, use and maintenance	Persons working on machinery which is being operated by a second person unaware of that work.
Mechanical	Instability	Crushing	Lack of stability	Incorrect dimensioning of structural elements and components.
			Incorrect loading, overloading, exceeding specified overturning moments	Improper force or load transmission, stability calculations not carried out for the exceptional load.
			Unintentional movement due to mechanical failure	Unintended turning, tilting, hanging, falling, uncontrolled lowering.
Mechanical	Instability	Drawing-in or trapping	Uncontrolled movements	Uncontrolled speeds.
Mechanical	Instability	Drawing-in or trapping	Incorrect loading, overloading, exceeding specified overturning moments	Above-stage machinery: Large loads (scenery) underneath the fly grid. Overload shut-off incorrectly adjusted or not functioning properly and the lifting mechanism is overloaded.
Mechanical	Kinetic energy	Person(s) run over	Incorrect Operation	Tracking system travels to work position, persons stand in travel path.
Mechanical	Kinetic energy	Person(s) run over	Uncontrolled movements	Exceeding specified travel limits.
Mechanical	Kinetic energy	Crushing	Incorrect arrangement of machinery parts	Incorrect arrangements of lifting accessories or load bearing parts.
			Lack of stability	Incorrect dimensioning of structural elements and components.
			Incorrect loading, overloading, exceeding specified overturning moments	Improper force or load transmission, stability calculations not carried out for the exceptional load.
Mechanical	Moving elements	Crushing	Incorrect installation, testing, use and maintenance	Persons work in the immediate vicinity of a danger zone. Persons working on machinery which is being operated by a second person unaware of that work.
				Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
				Instructions for use are incomplete.
Mechanical	Moving elements	Drawing-in or trapping	Incorrect Operation	Obstacles in machinery travel path.
Mechanical	Moving elements	Slipping, tripping or falling	Slipping, tripping or falling of persons (related to machinery)	Open gaps which cannot be secured for artistic reasons.
Mechanical	Rough, slippery surface	Slipping, tripping or falling	Slipping, tripping or falling of persons (related to machinery)	Persons trip over tracking systems or slippery surfaces.
				When lighting is low, edges of exit stairs not illuminated and performers fall down stairs.
				Performers step onto stage and fall.
Mechanical	Rotating elements	Drawing-in or trapping	Drawing-in or trapping	Hazards at winding devices and diverter pulleys.
Mechanical	Sharp edges	Cutting or severing	Friction, abrasion, cutting or severing	Contact with unfinished cast, machined or other surfaces.
Mechanical	Sharp edges	Cutting or severing	Friction, abrasion, cutting or severing	Person grabbing moving wire ropes.
Mechanical	Stored Energy	Crushing	Crushing	Gravitational energy released by a suspended load if primary or secondary brake is manually released.
Electrical	Electromagnetic phenomena	Effects on medical implants	Electro Magnetic Interferences	Strong electromagnetic field generated by a frequency drive inverter.
Electrical	Electromagnetic phenomena	Effects on medical implants	Electro Magnetic Interferences	Motors or transformers not suitable for the application.
Electrical	Electrostatic phenomena	Shock	Electrostatic phenomena	Electric shock due to persons coming in contact with charged parts.
Electrical	Live parts	Electrocution	Person(s) in contact with live parts (i.e. parts which are normally live)	Electric shock due to direct contact.
Electrical	Live parts	Electrocution	Person(s) in contact with parts which have become live under faulty conditions	Electric shock due to indirect contact, e.g. due to faulty or inadequate insulation or lack of equipotential bonding.
Electrical	Live parts	Falling or being thrown	Person(s) in contact with parts which have become live under faulty conditions	Person falling due to electric shock caused by coming in contact with live parts.
Electrical	Overload	Burn	Overheating of electrical components	Heat generating components – heat sinks, power resistors – generating excessive temperatures.
Electrical	Overload	Fire	Overheating of electrical components	Electrical current or heat generating components overheat and cause a fire.
Electrical	Parts which have become live under fault conditions	Electrocution	Person(s) in contact with parts which have become live under faulty conditions	Electric shock due to indirect contact, e.g. due to faulty or inadequate insulation or lack of protective devices, MCB's or RCD's.
Electrical	Power failure	Crushing	Hazards due to failure in the power supply	When power supply is interrupted, movement is not stopped and is no longer controlled.
				Synchronization tolerances are exceeded.
				Power storage runs out and scenery falls.
				When power supply is interrupted, motor performs a Cat. 0 stop with consequent shock load.
Electrical	Short-circuit	Fire	Shortcut between live parts	Shortcut between live parts creates severe overheating with possible burns or fire.
Electrical	Short-circuit	Fire	Shortcut between live parts	Component failure.
Unintentional	Unintentional movement	Entanglement	Failure/malfunctioning of the control system	Increase in travel speed.
Unintentional	Unintentional movement	Entanglement	Interruption/restoration of energy supply	Unintentional start-up, stop command is not carried out, e.g. after power failure, uncontrolled start-up of hoist.
Unintentional	Unintentional movement	Crushing	Failure/malfunctioning of the control system	Unintentional start-up, stop command is not carried out, e.g. wrong hoist starts up.
				Synchronous travel is no longer ensured.
				Emergency stop occurs too late.
Noise	Harmonics Frequencies	Stress	High frequency noise	(Noise generated in) machinery rooms or drive system area.
Noise	Moving parts	Stress	Mechanical noise	(Noise generated in) machinery rooms or drive system area.
Ergonomic	Design or location of indicators and visual displays units	Any other consequences of human error	Inadequate design, location or identification of manual controls	ESTOP or ENABLE stations are located too far from the movement/lifting area.
Ergonomic	Design or location of indicators and visual displays units	Any other consequences of human error		Inadequate software ergonomics.
Ergonomic	Local lighting	Any other consequences of human error	Inadequate local lighting	Insufficient working light for operations such as motor repairs.
Ergonomic	Local lighting	Any other consequences of human error	Inadequate design of visual display units	Displays which are too small lead to reading errors.
Ergonomic	Repetitive activity	Any other consequences of human error	Unhealthy postures or excessive effort	Unsuitable arrangement of controls.
Ergonomic	Repetitive activity	Any other consequences of human error	Unhealthy postures or excessive effort	Excessive holding or actuating forces required.
Ergonomic	Visibility	Any other consequences of human error	Inadequate design, location or identification of manual controls	User interface location or control station is too far from the lifting area.
				Levers too far apart cannot be operated by one person simultaneously.
				Controls reset automatically and hoist continues to travel unintentionally.
				Intended uses of machinery are disregarded.
Environment	Lightning	Fire	Hazards due to lightning	Machinery installed in outdoor application hit by lightning.
Environment	Lightning	Electrocution	Hazards due to lightning	Machinery installed in outdoor application hit by lightning.
Improper use	Unauthorized start-up/use	Crushing	Unauthorized start-up/use	Unauthorized use of machinery.
Improper use	Hazards due to improper operation	Crushing	Hazards due to improper operation	Manufacturers intended uses of machinery are disregarded by the user.
				Factors which can lead to damage are not recognized.
				Failure to observe travel areas of machinery and suspended loads.
			Lack or inadequacy of visual or acoustic warning signals	Technical personnel leave stage during intermission.

(normative)

Use case definitions
1. General

The following use cases (see Tables B.1 to B.4) are defined to reflect common machinery risk scenarios ranging from relatively low to high. For each use case, guidance on the safety functions to be implemented is given in Annex C.

1. Upper machinery - lifting

Table B.1 — Use cases for upper machinery - lifting

Use Case	Description	Examples
UC1	No-one in hazard zone during motion, statically determinate load, Speed < 0,2 m/s	Hoists for the movement and suspension of decorations or technical equipment during set-up, stage preparation, installation, assembly lifting operations and show time scenic movements which do not move with persons in the hazard zone.
UC2	No-one in hazard zone during motion, statically indeterminate Load, Speed < 0,2 m/s
UC3	Person(s) in hazard zone during motion, no shared load	Hoists for the suspension of decorations or technical equipment that move with persons in the hazard zone, typically as part of a performance or rehearsal. The decoration or equipment is moved by a single machine or multiple machines.
UC4	Person(s) in hazard zone during motion, shared load
UC5	Moving person(s) suspended, no shared load	Persons suspended in a harness from a single point hoist or bar, or riding on a platform that is moved and suspended by a single point hoist or multi-line hoist.
UC6	Moving person(s) suspended, shared load	3D person flying using triangulated and synchronized point hoists or persons riding a platform suspended from multiple hoists.

SD – Statically determinate load system

In statically determinate load systems all loads and reactions (applied loads of the individual axes and therefore of the suspension points) are known. Examples of statically determinate load systems include:

a) loads on individual axes (point load or multi-line winch);

b) distributed loads on two axes.

SI – Statically indeterminate load systems

In statically indeterminate load systems the reactions (applied loads of the individual axes and therefore of the suspension points) cannot be fully determined. Examples of statically indeterminate load systems include:

c) distributed loads on more than two axes;

d) guided loads.

1. Upper machinery – horizontal movement

Table B.2 — Use cases for upper machinery – horizontal movement

Use Case	Description	Examples
UC-USH1	No-one in hazard zone, Speed <1 m/s, no shared load	Linear or curved tracking systems, motorized trolleys, travel beam trolleys, suspended revolving devices or rotators intended for moving decorations or equipment, with a maximum linear or tangential speed of 1 m/s, operated with full and clear visibility of the hazard zone.
UC-USH2	No-one in hazard zone, Speed <1 m/s, shared load
UC-USH3	Person(s) in hazard zone, no shared load	Linear or curved tracking systems, motorized trolleys, travel beam trolleys, suspended revolving devices or rotators intended for moving decorations or equipment, while people are in the hazard zone or the full and clear visibility of the hazard zone cannot be guaranteed.
UC-USH4	Person(s) in hazard zone, shared loads

1. Lower machinery – lifting

Table B.3 — Use cases for lower machinery – lifting

Use Case	Description	Examples
UC-LSL1	Person(s) in hazard zone, no shear edges, short travel range < 0,4 m and low risk from platform dropping, no shared load.	Lifts that are intended for creating or levelling limited height differences in the stage or auditorium floor. This includes steps to access higher levels (stairs), limited height steps for better visibility of artists (podiums) or steps that arise from moving or removing parts of the former floor (stage wagons, show deck). Such lifts are often called compensator lifts, equalizer lifts or ramp lifts.
UC-LSL2	Person(s) in hazard zone, no shear edges, short travel range < 0,4 m and low risk from platform dropping, shared load.
UC-LSL3	No-one in hazard zone, Speed < 0,15 m/s^a, no shared load.	Lifts intended for changing the height or shape of the stage floor, orchestra pit or auditorium floor. Lifts intended for transport of decorations, technical equipment, seats or seating wagons from a storage area to the stage or auditorium area with no persons travelling on the lift. Lifts intended for moving during the transforming of the auditorium floor from flat floor to seated floor. Such lifts are often called orchestra pit lifts, transport lifts, (mixing) console lifts, auditorium lifts or seating lifts.
UC-LSL4	No-one in hazard zone, Speed < 0,15 m/s^a, shared load.
UC-LSL5	Person(s) in hazard zone, no shared load.	Lifts intended for programmed or manual scene changes or lifting actors while people are in the hazard zone or the full and clear visibility of the hazard zone cannot be guaranteed. Such lifts are often called stage lifts, actor lifts or performer lifts.
UC-LSL6	Person(s) in hazard zone, shared load.
^a The Machinery Directive 2006/42/EC, Article 24 (section 3) creates a distinction between devices operating below and above 0,15 m/s.

1. Lower machinery – horizontal movement

Table B.4 — Use cases for lower machinery – horizontal movement

Use Case	Description	Examples
UC-LSH1	Rotation only, Person(s) in hazard zone, no shared load	Turntables, revolving ring stages, revolving cylinder stages intended for moving decorations, equipment or persons while people are in the hazard zone or the full and clear visibility of the hazard zone cannot be guaranteed.
UC-LSH2	Rotation only, Person(s) in hazard zone, shared load
UC-LSH3	Translation movement, No-one in hazard zone, Speed < 1 m/s, no shared load	Stage wagons or similar machines intended for moving decorations or equipment on/off stage or seats or seating wagons into/from auditorium, with full and clear visibility of the hazard zone.
UC-LSH4	Translation movement, No-one in hazard zone, Speed < 1 m/s, shared load
UC-LSH5	Translation movement, Person(s) in hazard zone, no shared load	Stage or seating wagons or similar machines intended for moving decorations, equipment or persons on top on/off stage or into/from auditorium, with programmable control. Floor tracks intended for moving decorations on/off stage while people are in the hazard zone or the full and clear visibility of the hazard zone cannot be guaranteed.
UC-LSH6	Translation movement, Person(s) in hazard zone, shared load

(informative)

Recommended safety functions and measures
1. General

The following Tables C.1 to C.4 contain guidance on the most common safety functions to be considered for a range of machinery movement use cases. For each use case guidance on the safety functions to be implemented is given based on a generic risk assessment.

The machinery designer should consider the following non-exhaustive lists of safety functions but is still responsible for performing their own risk assessment and should consider additional safety functions to address specific hazards.

Key:

—	The safety function has no recommendation for or against being used;
R	The safety function is recommended for this use case;
HR	The safety function is highly recommended for this use case. If this safety function is not implemented, then the rationale behind not using it should be detailed.

NOTE Stop categories are defined in EN 60204-1

1. Upper machinery - lifting

Table C.1 — Upper machinery (lifting) recommended safety functions and measures

Safety Function or Measure	UC1	UC2	UC3	UC4	UC5	UC6
Emergency Stop^a – category 0 or 1	HR	HR	HR	HR	HR	HR
Stop on “Deadman” Release – category 0, 1 or 2	HR	HR	HR	HR	HR	HR
Protection against position deviation	—	—	HR	HR	HR	HR
Protection against speed deviation	—	—	HR	HR	HR	HR
Protection against loss of group Synchronization	—	R^b	—	HR^c	—	HR
Protection against over-speed	—	—	HR	HR	HR	HR
Protection against overload	HR	HR	HR	HR	HR	HR
Protection against underload	—	R	—	HR	HR	HR
Protection against unplanned load deviations (Load Profile Monitoring)	—	R^b	R	R^c	R	R
Protection against slack condition	—	R	HR	HR	HR	HR
Limitation of travel^d	HR	HR	HR	HR	HR	HR
Protection against improper winding	HR	HR	HR	HR	HR	HR
Protection against brake failure^e	—	—	HR	HR	HR	HR
Protection against power source failures	HR	HR	HR	HR	HR	HR
^a Although it is sometimes argued that an Emergency stop is not a safety function, in the context of stage machinery it could be considered part of the operator safety loop. ^b UC2 – either Loss of Group Synchronization or Overload Protection shall be provided. ^c UC4 – either Loss of Group Synchronization or Overload Protection shall be provided. ^d Required only where over travel could result in mechanical damage or failure. ^e Protection against brake failure includes brake air-gap monitoring and similar technologies. Manual inspection of brakes to ensure their safety shall always be undertaken for all classes of machine.

1. Upper machinery – horizontal movement

Table C.2 — Upper machinery (horizontal movement) recommended safety functions and measures

Safety Function or Measure	UC-USH1	UC-USH2	UC-USH3	UC-USH4
Emergency stop – category 0 or 1	HR	HR	HR	HR
Stop on deadman release – category 0, 1 or 2	HR	HR	HR	HR
Protection against position deviation	—	—	HR	HR
Protection against speed deviation	R	R	HR	HR
Protection against overspeed	HR	HR	HR	HR
Protection against loss of group synchronization	—	R	—	HR
Limitation of travel ^a	HR	HR	HR	HR
Protection against improper winding	R	R	R	R
Protection against power source failures	R	HR	R	HR
Protection against brake failure ^b	—	—	R	R
^a Required only where over travel could result in mechanical damage or failure. ^b Required only where brake failure could result in mechanical damage or failure. Protection against brake failure includes brake air-gap monitoring and similar technologies. Manual inspection of brakes to ensure their safety shall always be undertaken for all classes of machine.

1. Lower machinery – lifting

Table C.3 — Lower machinery (lifting) recommended safety functions and measures

Safety Function or Measure	UC-LSL1	UC-LSL2	UC-LSL3	UC-LSL4	UC-LSL5	UC-LSL6
Emergency Stop – category 0 or 1	HR	HR	HR	HR	HR	HR
Stop on Deadman Release – category 0, 1 or 2	HR	HR	HR	HR	HR	HR
Protection against position deviation	—	—	—	—	HR	HR
Protection against speed deviation	—	—	R	R	HR	HR
Protection against over-speed	R	R	HR	HR	HR	HR
Protection against overload	R	R	R	R	HR	HR
Protection against underload/slack situation	—	—	HR	HR	HR	HR
Protection against unplanned load change (Load Profile Monitoring)	—	—	R	R	R	R
Protection against loss of group synchronization	—	HR	—	HR	—	HR
Limitation of Travel	HR	HR	HR	HR	HR	HR
Protection against improper winding	R	R	HR	HR	HR	HR
Protection against crushing/shearing	R	R	R	R	HR	HR
Protection against brake failure^a	R	R	HR	HR	HR	HR
Protection against power source failures	—	—	R	R	HR	HR
Protection against collisions with other machines	—	—	—	—	HR	HR
Protection against persons falling/accessing dangerous moving areas	R	R	HR	HR	R	R
Protection against dangerous door access	R	R	HR	HR	HR	HR
Protection against drive transmission positive connection failure	R	R	HR	HR	HR	HR
^a Protection against brake failure includes brake air-gap monitoring and similar technologies. Manual inspection of brakes to ensure their safety shall always be undertaken for all classes of machine

1. Lower machinery – horizontal movement

Table C.4 — Lower machinery (horizontal movement) recommended safety functions and measures

Safety Function or Measure	UC-LSH1	UC-LSH2	UC-LSH3	UC-LSH4	UC-LSH5	UC-LSH6
Emergency stop – category 0 or 1	HR	HR	HR	HR	HR	HR
Stop on deadman release – category 0, 1 or 2	HR	HR	HR	HR	HR	HR
Protection against position deviation	R	R	—	—	HR	HR
Protection against speed deviation	R	R	R	R	HR	HR
Protection against overspeed	HR	HR	HR	HR	HR	HR
Protection against loss of group synchronization	—	HR	—	HR	—	HR
Limitation of travel	—	—	HR	HR	HR	HR
Protection against improper winding	R	R	R	R	R	R
Protection against power source failures	R	HR	R	HR	R	HR
Protection against collisions with other machines	—	—	R	R	HR	HR
Protection against moving into open pit areas	—	—	R	R	HR	HR
Protection against persons falling/accessing dangerous moving areas	—	—	R	R	R	R
Protection against dangerous door access	R	R	R	R	R	R

(normative)

End user information table to be supplied by the manufacturer

The manufacturer shall supply information for the implemented safety functions as applicable. The information shall be displayed prominently on the equipment, or in the associated manuals for the equipment. Additional information that is required for a particular installation shall be identified by risk assessment. Either design data or data derived from testing may be presented. The type of data presented shall be indicated. Where test data are provided the test and measurement methods shall be described. Response time data shall include the combined response times of the electrical and mechanical systems.

NOTE 1 Stop categories are defined in EN 60204-1.

NOTE 2 The information to be provided in Table D.1 is in addition to the information specified in 8.2.

Table D.1 — Example end user information table

Safety Function	Parameter	Units	Design or test data
Category 0 stop	Fastest peak deceleration rate (low load with all load securing devices operating at maximum efficiency)	ms^–2	D/T
	Slowest deceleration rate (high load with minimum allowable number of load securing devices operating at minimum efficiency)	ms^–2
	Worst-case reaction time	ms
	Shortest stopping distance from point of activation	mm
	Longest stopping distance from point of activation	mm
Emergency stop	Category of stop [0 or 1]
	SIL/PL
	Emergency deceleration rate	ms^–2
	Worst-case reaction time	ms
	Worst-case stopping distance from time of activation	mm
Stop on hold to run (“deadman”) release	Category of stop [0, 1 or 2]
	SIL/PL
	Deceleration rate	ms^–2
	Worst-case reaction time	ms
	Worst-case stopping distance from time of activation	mm
Protection against position deviation	SIL/PL
	Category of stop [0 or 1]
	Maximum position error during normal travel	mm
	Maximum target position error	mm
	Response to excessive position deviation
Protection against speed deviation	SIL/PL
	Category of stop [0 or 1]
	Maximum speed error during normal travel	ms^–1
	Response to excessive speed deviation (e.g. Warning or Stop)
Protection against loss of group Synchronization	Category of stop [0, 1 or 2]
	SIL/PL
	Deceleration rate of the machine that has lost synchronization	ms^–2
	Worst-case reaction time of the machine that has lost synchronization	ms
	Deceleration rate of other machines in group	ms^–2
	Worst-case reaction time of other machines in group	ms
	Worst-case synchronization error (distance) between the machines which has lost synchronization and other members of the group	mm
Protection against over-speed	SIL/PL
Protection against over-speed	Category of stop [0 or 1]
Protection against overload	Category of stop [0, 1 or 2]
	SIL/PL
	Deceleration rate	ms^–2
	Worst-case reaction time	ms
	Worst-case stopping distance from time of activation	mm
Protection against underload	Category of stop [0, 1 or 2]
	SIL/PL
	Deceleration rate	ms^–2
	Worst-case reaction time	ms
	Worst-case stopping distance from time of activation	mm
Protection against unplanned load deviations (Load Profile Monitoring)	Category of stop [0, 1 or 2]
	SIL/PL
	Minimum detectable load deviation	kg
	Deceleration rate	ms^–2
	Worst-case reaction time	ms
	Worst-case stopping distance from time of activation	mm
Protection against slack condition	Category of stop [0, 1 or 2]
	SIL/PL
	Deceleration rate	ms^–2
	Worst-case reaction time	ms
	Worst-case stopping distance from time of activation	mm
Limitation of travel – Initial limits	Category of stop [0, 1]
	SIL/PL
	Worst-case over-travel distance beyond initial limit detection point	mm
Limitation of travel – Ultimate limits (this shall be a Cat 0 stop)	Category of stop [0],
	SIL/PL
	Worst-case over-travel distance beyond ultimate limit detection point	mm
Protection against Improper winding	Category of stop [0, 1]
	SIL/PL
	Worst-case travel distance from point of activation	mm
Automatic protection against brake failure	SIL/PL
Protection against power source failures	SIL/PL

(informative)

Designing safeguards on the basis of risk assessment
1. General

The mechanical and electrical equipment of machinery installations as in this document shall at times perform safety functions.

The safety requirements for equipment which performs safety functions, and the measures needed to fulfil those requirements, can vary considerably. A combination of technical and non-technical measures (e.g. organizational measures) can be employed to realize the safety functions to be performed by the system.

As a rule, the greater the risk, the more stringent the necessary safety requirements and measures will be. By combining electrical and non-electrical protective measures, the risk can be reduced at least to a tolerable level.

The risk reduction possible by means of safeguarding will depend on the solution selected and, theoretically, can lie between 0 % and 100 % of the necessary minimal risk reduction for one and the same application. This means that various equivalent measures can be taken to cover the risks associated with the electrical system.

The methods described in this Annex for assessing risks associated with safety-related equipment:

a) are independent of the application and technology upon which the electrical protective system is based (that is, they can be used for electro-mechanical, electronic or hydraulic systems alike);

b) cannot be used for complete systems (installations), but only for the particular safety function under consideration.

1. Risk assessment as in EN 62061
  1. General

Risk estimation should be carried out for each hazard by determining the risk parameters that as shown in Figure E.1 should be derived from the following:

a) severity of harm, Se;

b) probability of occurrence of that harm, which is a function of:

1) frequency and duration of the exposure of persons to the hazard, Fr;

2) probability of occurrence of a hazardous event, Pr;

3) possibilities to avoid or limit the harm, Av.

Figure E.1 — Parameters used in risk estimation

The estimates entered into Table E.6 should normally be based on worst-case considerations for the Safety Related Control Function (SRCF). However, in a situation where, for example, an irreversible injury is possible but at a significantly lower probability than a reversible one, then each severity level should have a separate line in the table. It may be the case that a different SRCF is implemented for each line. If one SRCF is implemented to cover both lines, then the highest target SIL requirement should be used.

- 1. Guidance for selecting parameters Se, Fr and Pr for the risk estimation
    1. Severity of injury (Se)

Severity of injuries or damage to health can be estimated by taking into account reversible injuries, irreversible injuries and death. Choose the appropriate value of severity from Table E.1 based on the consequences of an injury, where:

4	is a fatal or a significant irreversible injury such that it will be very difficult to continue the same work after healing, if at all;
3	is a major or irreversible injury in such a way that it can be possible to continue the same work after healing. It can also include a severe major but reversible injury such as broken limbs;
2	is a reversible injury, including severe lacerations, stabbing, and severe bruises that requires attention from a medical practitioner;
1	is a minor injury including scratches and minor bruises that require attention by first aid.

Select the appropriate row for consequences (Se) of Table E.1.

Table E.1 — Severity (Se) classification

Severity of injury (Se)
Consequences	Severity (Se)
Irreversible: death, losing an eye or arm	4
Irreversible: broken limb(s), losing a finger(s)	3
Reversible: requiring attention from a medical practitioner	2
Reversible: requiring first aid	1

- - 1. Probability of occurrence of harm

Each of the three parameters of probability of occurrence of harm (i.e. Fr, Pr and Av) should be estimated independently of each other. A worst-case assumption needs to be used for each parameter to ensure that SRCF(s) are not incorrectly assigned a lower SIL than is necessary. Generally, the use of a form of task-based analysis is strongly recommended to ensure that proper consideration is given to estimation of the probability of occurrence of harm.

- - 1. Frequency and duration of exposure (Fr)

Consider the following aspects to determine the level of exposure:

a) need for access to the hazard zone based on all modes of use, for example normal operation, maintenance;

b) nature of access, for example persons required to be in the danger zone as part of daily performances, used monthly for equipment setup with no requirement for persons to be in the hazard zone.

It should then be possible to estimate the average interval between exposures and therefore the average frequency of access.

It should also be possible to foresee the duration, for example if it will be longer than 10 min. Where the duration is shorter than 10 min, the value may be decreased to the number in the row below in Table E.2. This does not apply to frequency of exposure ≤ 1 h, which should not be decreased at any time.

The duration is related to the performance of activities that are carried out under the protection of the SRCF. The requirements of EN 60204‑1 and ISO 14118 with regard to power isolation and energy dissipation should be applied for major interventions.

This factor does not include consideration of the failure of the SRCF.

Select the appropriate row for frequency and duration of exposure (Fr) of Table E.2.

Table E.2 — Frequency and duration of exposure (Fr) classification

Frequency and duration of exposure (Fr)
Frequency of exposure	Frequency (Fr)
≥ 1 per h	5
< 1 per h to ≥ 1 per day	5
< 1 per day to ≥ 1 per 2 weeks	4
< 1 per 2 weeks to ≥ 1 per year	3
< 1 per year	2

- - 1. Probability of occurrence of a hazardous event

The probability of occurrence of harm should be estimated independently of other related parameters Fr and Av. A worst-case assumption should be used for each parameter to ensure that SRCF(s) are not incorrectly assigned a lower SIL than is necessary. To prevent this occurring, the use of a form of task-based analysis is strongly recommended to ensure that proper consideration is given to estimation of the probability of occurrence of harm.

This parameter can be estimated by considering:

a) Predictability of the behaviour of component parts of the machine relevant to the hazard in different modes of use (e.g. normal operation, maintenance, fault finding). This will necessitate careful consideration of the control system especially with regard to the risk of unexpected start up. Do not take into account the protective effect of any SRECS. This is necessary in order to estimate the amount of risk that will be exposed if the SRECS fails. In general terms, it shall be considered whether the machine or material being processed has the propensity to act in an unexpected manner.

The machine behaviour will vary from very predictable to not predictable but unexpected events cannot be discounted.

NOTE Predictability is often linked to the complexity of the machine function.

b) The specified or foreseeable characteristics of human behaviour with regard to interaction with the component parts of the machine relevant to the hazard. This can be characterized by:

— stress (e.g. due to time constraints, work task, perceived damage limitation); and/or

lack of awareness of information relevant to the hazard. This will be influenced by factors such as skills, training, experience, and complexity of machine/process.

These attributes are not usually directly under the influence of the SRECS designer, but a task analysis will reveal activities where total awareness of all issues, including unexpected outcomes, cannot be reasonably assumed.

“Very high” probability of occurrence of a hazardous event should be selected to reflect normal production constraints and worst-case considerations. Positive reasons (e.g. well-defined application and knowledge of high level of user competences) are required for any lower values to be used.

Any required or assumed skills, knowledge, etc. should be stated in the information for use.

Select the appropriate row for probability of occurrence of hazardous event (Pr) of Table E.3.

Table E.3 — Probability (Pr) classification

Probability of occurrence (Pr)
Probability of occurrence	Probability (Pr)
Very high	5
Likely	4
Possible	3
Rarely	2
Negligible	1

- - 1. Probability of avoiding or limiting harm (Av)

This parameter can be estimated by taking into account aspects of the machine design and its intended application that can help to avoid or limit the harm from a hazard. These aspects include, for example:

a) sudden, fast or slow speed of appearance of the hazardous event;

b) spatial possibility to withdraw from the hazard;

c) the nature of the component or system, for example a knife is usually sharp, a pipe in a dairy environment is usually hot, electricity is usually dangerous by its nature but is not visible;

d) possibility of recognition of a hazard, for example electrical hazard: a copper bar does not change its aspect whether it is under voltage or not; to recognize if one needs an instrument to establish whether electrical equipment is energized or not; ambient conditions, for example high noise levels can prevent a person hearing a machine start.

Select the appropriate row for probability of avoidance or limiting harm (Av) of Table E.4.

Table E.4 — Probability of avoiding or limiting harm (Av) classification

Probabilities of avoiding or limiting harm (Av)
Probabilities of avoiding or limiting harm	Avoidance (Av)
Impossible	5
Rarely	3
Probable	1

- - 1. SIL assignment

Using Table E.5 where the severity (Se) row crosses the relevant column (Cl), the intersection point indicates whether action is required. The darker shaded areas indicate the SIL assigned as the target for the SRCF. The lighter shaded areas should be used as a recommendation that other measures (OM) be used.

Table E.5 — SIL assignment matrix

Severity (SE)	Class (Cl = Fr + Pr + Av)
Severity (SE)	4	5–7	8–10	11–13	14–15
4	SIL 2	SIL 2	SIL 2	SIL 3	SIL 3
3		(OM)	SIL 1	SIL 2	SIL 3
2			(OM)	SIL 1	SIL 2
1				(OM)	SIL 1

Table E.6 — Risk assessment form

Document No:

Risk assessment and safety measures

Part of:

Product:

⎕

Pre risk assessment

Issued by:

Dark grey area = Safety measures required

Light grey area = Safety measures recommended

⎕

Intermediate risk assessment

Date:

⎕

Follow up risk assessment

Consequences

Severity

Class

Frequency

Probability of hdz. event

Avoidance

5–7

8–10

11–13

14–15

Death, losing an eye or arm

SIL 2

SIL 3

≥ 1 per hr

Common

Permanent, losing fingers

(OM)

SIL 1

SIL 2

SIL 3

< 1 per hr ≥ 1 per day

Likely

Reversible, medical attention

(OM)

SIL 1

SIL 2

< 1 per day ≥ 1 per 14 days

Possible

Impossible

Reversible, first aid

(OM)

SIL 1

< 1 per 2 wks ≥ 1 per yr

Rarely

Possible

< 1 per yr

Negligible

Likely

Ser.	Hzd.	Hazard	Se	Fr	Pr	Av	Cl	Safety measure	Safe
No.	No.	Hazard	Se	Fr	Pr	Av	Cl	Safety measure	Safe

	Comments

1. Risk assessment as in EN ISO 13849‑1
  1. General

The risk assessment assumes a situation prior to provision of the intended safety function. Risk reduction by other technical measures independent of the control system (e.g. mechanical guards), or additional safety functions, can be considered when determining the PL_r of the intended safety function; in which case, the starting point of Figure E.2 can be selected after the implementation of these measures. The severity of injury (denoted by S) is relatively easy to estimate (e.g. laceration, amputation, fatality). For the frequency of occurrence, auxiliary parameters are used to improve the estimation. These parameters are:

a) frequency and time of exposure to the hazard (F); and

b) possibility of avoiding the hazard or limiting the harm (P).

Experience has shown that these parameters can be combined, as in Figure E.2, to give a gradation of risk from low to high. It is emphasized that this is a qualitative process giving only an estimation of risk.

- 1. Guidance for selecting parameters S, F and P for the risk estimation
    1. Severity of injury S1 and S2

In estimating the risk arising from a failure of a safety function only slight injuries (normally reversible) and serious injuries (normally irreversible) and death are considered.

The usual consequences of accidents and normal healing processes should be taken into account in determining S1 and S2. For example, bruising and/or lacerations without complications would be classified as S1, whereas amputation or death would be S2.

- - 1. Frequency and/or exposure times to hazard, F1 and F2

Absolute time periods for parameter F1 or F2 cannot be specified, however, the following explanation may assist in making the right decision where doubt exists.

F2 should be selected if a person is frequently or continuously exposed to the hazard. It is irrelevant whether the same or different persons are exposed to the hazard on successive exposures, e.g. different members of an acting company using a lift or standing under moving scenery. The frequency parameter should be chosen according to the frequency and duration of exposure of all persons to the hazard.

Where the demand on the safety function is known by the designer, the frequency and duration of this demand can be chosen instead of the frequency and duration of exposure to the hazard.

The period of exposure to the hazard should be evaluated based on an average value which can be seen in relation to the total period of time over which the equipment is used.

- - 1. Possibility of avoiding the hazard P1 and P2

It is important to know whether a hazardous situation can be recognized and avoided before leading to an accident. For example, an important consideration is whether the hazard can be directly identified by its physical characteristics, or recognized only by technical means, e.g. indicators. Other important aspects which influence the selection of parameter P include, for example:

a) operation with or without supervision;

b) operation by experts or non-professionals;

c) speed with which the hazard arises (e.g. quickly or slowly);

d) possibilities for hazard avoidance (e.g. by escaping from the hazard zone);

e) Well established safety practices related to the process.

When a hazardous situation occurs, P1 should only be selected if there is a realistic chance of avoiding an accident or of significantly reducing its effect; P2 should be selected if there is almost no chance of avoiding the hazard.

Figure E.2 provides guidance for the determination of the safety-related PL_r depending on the risk assessment. The graph should be considered for each safety function. The risk assessment method is based on EN ISO 12100.

Where the probability of occurrence of a hazardous event can be justified as low, the PL_r may be reduced by one level.

The probability of occurrence of a hazardous event depends on either human behaviour or technical failures. In most cases, the appropriate probabilities are unknown or hard to identify. The estimation of the probability of occurrence of a hazardous event should be based on factors including:

1) reliability data;

2) history of accidents on comparable machines.

Key

1	starting point for evaluation of safety function’s contribution to risk reduction
L	low contribution to risk reduction
H	high contribution to risk reduction
PL_r	required performance level
Risk parameters:
S	severity of injury
S1	slight (normally reversible injury)
S2	serious (normally irreversible injury or death)
F	frequency and/or exposure to hazard
F1	seldom-to-less-often and/or exposure time is short
F2	frequent-to-continuous and/or exposure time is long
P	possibility of avoiding hazard or limiting harm
P1	possible under specific conditions
P2	scarcely possible

Figure E.2 — Risk graph for determining required PL_r for safety function

(informative)

Examples of using the risk graphs
1. Guidance for risk evaluation values for control system functions

Risk shall primarily be reduced by intrinsically safe design of the mechanical system first. If the risk needs to be reduced further by a safety related function of the control system, follow the guidance of the following chapter.

A machine or a system of machines shall be evaluated to determine which safety functions are required to reduce associated risks to a tolerable level. Annex B provides guidance for the selection of safety functions for specific use cases. Each safety function in combination with the mechanical system and the anticipated use-case needs to be individually assessed to identify the required performance or integrity level. Generic hard specified risk reduction levels (SIL or PL_r) cannot be provided in this document, since these levels greatly depend on the risk-reduction measures already achieved by other design measures (e.g. by inherently safe design) and the use-case of the machine or the system.

The following parameters are based on “typical mechanical designs” and “typical entertainment use” as defined in the use cases and may be used as general guidance to evaluate the SIL or PL_r requirements of safety functions.

The following section provides guidance for risk graph parameters for the upper machinery use cases.

Different parameters apply for lower stage and stage machinery. If the machines do not directly fall into the described use-cases or the machine is not a “typical” design, additional and/or different hazard scenarios will need to be considered and evaluated.

The following guidance only applies to upper machinery use cases UC1 to UC6 covering set-up use with speeds < 0,2 m/s through to high speed performer flying (see Annex B). Generic guidance for wagons and lower stage machinery cannot be provided here due to the greater amount of variation with these machines and the surrounding building, making it difficult to evaluate “typical” hazards.

1. Severity

For uses cases UC1 and UC2 it is reasonable to assume that the machinery would remain at slow speed and under full control should a person enter the hazardous zone. Therefore, the highest severity may be assumed to drop to (Se) 3 under EN 62061 or S2 under EN ISO 13849‑1.

For UC3 to UC6 there is always the potential for severity 4 under EN 62061 or S2 under EN ISO 13849‑1. See Table F.1.

Table F.1

EN ISO 13849‑1

Severity (S)

Use

Case

EN 62061

Severity (Se)

UC-1, UC-2

UC-3, UC-4, UC-5, UC-6

1. Possibility of avoiding the hazardous event

For UC1 and UC2 it is reasonable to assume that the machinery would remain at slow speed and under full control should a person enter the hazardous zone. Therefore, the possibility of avoidance may be assumed to be (Av) 1 under EN 62061 or P1 under EN ISO 13849‑1.

For UC3 and UC4 the possibility of avoidance cannot be less than (Av) 3 under EN 62061 or P2 under EN ISO 13849‑1.

Under certain conditions such as work lighting (providing increased visibility), a requirement for additional spotters with permissive controls, reduced size or weight of the moving component or other specific site conditions that make the hazardous event more avoidable, P1 or (Av) 1 could be used for UC3 and UC4 if a solid reasoning can be provided. Any required or assumed skills, knowledge, etc. shall be stated in the information for use.

For UC5 and UC6 the possibility of avoidance is always as (Av) 5 under EN 62061 or P2 under EN ISO 13849‑1 because the performer is assumed to be ‘attached’ to the machine. See Table F.2.

Table F.2

EN ISO 13849‑1 Probability of Avoidance (P)	Use Case	EN 62061 Probabilities of avoiding or limiting harm (Av)
P1	UC-1, UC-2	1
P2	UC-3, UC-4	3
P2	UC-5, UC-6	5

EN ISO 13849‑1

Probability of Avoidance (P)

Use

Case

EN 62061

Probabilities of avoiding or limiting harm (Av)

UC-1, UC-2

UC-3, UC-4

UC-5, UC-6

1. Possibility frequency and duration of exposure

The frequency and/or exposure times to the hazard can be derived from the use-cases defined in Annex B: Under EN ISO 13849‑1.

a) F₁: (UC1 and UC2) No persons in the hazard zone;

b) F₂: (UC3 to UC6) Persons in the hazard zone

In case of no other justification, F2 should be used. If you can ensure the intended use will be low frequencies and short exposures durations, the F1 level may be applied.

The means for preventing unintended motion shall always be classified as F2. Prevention of unintended motion may be achieved by disconnecting the power supply to the machine using a safety related E/E/PES (e.g. a dead man button).

NOTE For EN ISO 13849‑1:2023, F.1 can be applied when the accumulated exposure time is less than 1/20 of the overall operating time and the frequency is not higher than once per 15 min.

Under EN 62061, Fr is dependent on the frequency and duration of exposure as set out in the Table F.3 below:

Table F.3

EN ISO 13849‑1		Use case	EN 62061
Exposure	Score F		Frequency of exposure	Score^a Fr
Exposure	Score F		Frequency of exposure	Exposure more than 10 min	Exposure less than 10 min
Less than 15 min	F1	UC1, UC2	< 1per year	2	−/−
More than 15 min	F2	UC6, UC5, UC4, UC3	< 1 per 2 weeks to ≥ 1 per year	3	2
			< 1 per day to ≥ 1 per 2 weeks	4	3
			< 1 per hour to ≥ 1 per day	5	4
			≤ 1 per hour	5	5
A clear boundary for selection between F1 and F2 cannot be stated. EN ISO 13849‑1:2023, A.2.2 contains the non-prescriptive instruction that in cases where operator interventions occur more frequently than once per 15 min, F2 should be selected; otherwise, F1. It should also be possible to foresee the duration of the exposure, for example if it will be longer than 15 min. Where the duration is shorter than 15 min, F1 can be selected unless the frequency of exposure is ≤ 1 h, in which case F2 should always be selected.
^a According to EN 62061:2005, A.2.4.1 it is possible to reduce the score to the number of the row above, unless the frequency of exposure is < 1per year.

1. Probability of occurrence of a hazardous event

When evaluating the probability of an occurrence of a hazardous event, the assessment of how often a hazard would occur should be based on safety functions being present. Certain parameters such as “how often does the safety function get actuated”, “how much intrinsic safety is already designed into the machine”, “what does the machine do” as well as “who operates the machine” may be taken into consideration.

Any deviation from the default maximum score needs to have a solid reasoning and shall be well documented.

For EN 62061, a “Very high” probability of occurrence of a hazardous event with a score of 5 should be selected to reflect normal operating constraints and worst-case considerations. Positive reasons (e.g. well-defined application and knowledge of high level of user competences) are required for any lower values to be used.

Any required or assumed skills, knowledge, etc. shall be stated in the information for use.

For EN ISO 13849‑1 if the probability of occurrence of the hazardous event can be justified as low, the PL_r may be reduced by one level (not applicable in combination with the P1 parameter).

(informative)

Application examples
1. General

a) A designer should declare the intended use of the machinery based on the identification of use, space and time limits as specified in EN ISO 12100 and in accordance with the Use Cases as described in this document (see Annex B);

b) after performing the risk analysis (see Annex A, Table A.1), a risk evaluation should be carried out;

c) as result of a risk evaluation, the designer may choose to reduce a risk by the implementation of one or many safety functions (see Annex C) and the PL_r/SIL required for each safety function should be determined;

d) by estimating the elements of the risk (see Annex E), the designer can establish if the reliability of a chosen safety function is adequate to the risk being reduced;

e) the following examples provide guidance on how to identify, evaluate and estimate the elements of the risks related to individual safety functions;

f) When several safety functions are contributing to reduce an identical risk, the PL_r/SIL of each safety function shall be estimated.

NOTE The application examples presented in this annex are related to particular cases and they are not necessarily representative of all scenarios.

1. Chain hoist for a speaker cluster – Stop on “deadman release”

G.2.1 Description

This example describes the use of the Stop on “deadman release” safety function to reduce one of the hazards applicable to the chain hoist for a speaker cluster machine:

Use of a chain hoist to rig a speaker cluster from ground level. See Figure G.1.

Figure G.1 — Chain hoist for speaker cluster

- 1. Use Case identification – Annex B

The chain hoist has a maximum speed of 0,067 m/s (4 m/min) and it will be used for set-up purposes.

Based on the intended use of the machine, the speed limitation and the load configuration, the machine falls into UC1 (No-one in hazard zone during motion, statically determinate Load, Speed < 0,2 m/s).

- 1. Hazard definition – Annex A

Hazard Type:	Mechanical
Hazard Origin:	Approach of a moving element to a fixed part
Risk origin:	Incorrect operation
Hazardous Event:	Persons standing in the danger zone, disregarding safety instructions, before safety measures or guards have been implemented.
Potential Consequences:	Crushing

- 1. Safety function allocation – Annex C

Stop on “deadman release” safety function would reduce the risk to a person disregarding safety instructions and entering the hazard zone.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

No one should be in the hazard zone, and the lifting load is known, we could exclude death, but one person could get injured by the speaker leading to severe injuries.

EN ISO 13849‑1	EN 62061
S2	Se3

Frequency and duration of exposure (F, Fr)

Lowering the speaker cluster is a daily process, but it does not happen 365 days a year. The duration of the operation is less than 10 min.

EN ISO 13849‑1	EN 62061
F1	Fr3

Possibility of avoiding the hazardous event (P, Av)

The speed of the moving load is slow. The load dimensions are relatively small if the hoist is lowered onto a person there is a good chance that this person can just step to the side to avoid the crushing hazard.

EN ISO 13849‑1	EN 62061
P1	Av1

Probability of occurrence (Pr)

The operator is a trained rigger who knows that the hoist shall be stopped if people step into the hazard zone. However, it can be expected that somebody is stepping into the hazardous area disregarding safety measures in place.

EN ISO 13849‑1	EN 62061
Not low	Pr5

- 1. Safety function estimation – Annex E

Based on parameters S2, F1, P1, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLc.

Based on parameters Se3, Fr3, Av1 and Pr5, according to EN 62061 the required safety integrity level shall be at least SIL 1.

1. Broadcast studio lighting hoist – Protection against overload

G.3.1 Description

This example describes the use of the Protection against overload safety function to reduce one of the hazards applicable to the Broadcast studio lighting hoist machine:

Use of a broadcast studio lighting hoist to hang a small number of lights for set-up purposes. See Figure G.2.

Key

1	pantograph

Figure G.2 — Broadcast studio lighting hoist

- 1. Use Case identification – Annex B

The hoist has a maximum speed of 0,15 m/s and it will be used for set-up purposes.

- 1. Hazard definition – Annex A

Hazard Type:	Mechanical
Hazard Origin:	Moving elements
Risk origin:	Incorrect operation
Hazardous Event:	Obstacles in machinery travel path
Potential Consequences:	Drawing-in or trapping

- 1. Safety function allocation – Annex C

During a lifting operation, the load carrying device catches on scenery, cables, or adjacent suspended equipment. The operator might have limited visibility.

Protection against overload safety function would reduce the consequences of this hazardous event.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

No one should be in the hazard zone, and the lifting load is known, we could exclude death, but one person could get injured by the caught object leading to severe injuries.

EN ISO 13849‑1	EN 62061
S2	Se3

Frequency and duration of exposure (F, Fr)

Lowering the hoist is a daily process, but it does not happen 365 days a year. The duration of the operation is less than 10 min.

EN ISO 13849‑1	EN 62061
F1	Fr3

Possibility of avoiding the hazardous event (P, Av)

The speed of the moving load is slow. It is unknown from the manufacturer point of view the dimensions of the items caught. There might be the possibility the persons will not be able to avoid the hazard.

EN ISO 13849‑1	EN 62061
P1	Av3

Probability of occurrence (Pr)

The operator is a trained rigger who knows to observe the surroundings before moving the load. However, it is not rare for unknown items to be trapped in the load path.

EN ISO 13849‑1	EN 62061
Not low	Pr3

- 1. Safety function estimation – Annex E

Based on parameters S2, F1, P1, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLc.

Based on parameters Se3, Fr3, Av3 and Pr3, according to EN 62061 the required safety integrity level shall be at least SIL 1.

1. Group of winches lifting a common load – protection against loss of group synchronization

G.4.1 Description

This example describes the use of the protection against loss of group synchronization safety function to reduce one of the hazards applicable to the group of winches lifting a common load machine:

Use of a computerized control system and a group of 3 winches to lift a common load for scenic purposes. Actors are under the load when in movement. The winches have a maximum speed of 1,2 m/s. See Figure G.3.

Figure G.3 — Group of winches lifting a common load

- 1. Use Case identification – Annex B

Three winches lift a common load. The attached load is moved during performances while performers are underneath.

Based on the intended use of the machine and the load configuration, the machine falls into UC4 (Person(s) in hazard zone during motion, shared load).

- 1. Hazard definition – Annex A

Hazard Type:	Unintentional
Hazard Origin:	Unintentional Movement
Risk origin:	Failure/malfunctioning of the control system
Hazardous event:	Synchronous travel is no longer ensured
Hazard Consequences:	Crushing

- 1. Safety function allocation – Annex C

During a lifting operation, the operator does not select one of the hoists in a group of hoists or there is a failure in one of the hoists. The operator might have limited visibility. The control system shall stop motion of any machine in the group once the synchronization tolerances are exceeded. (See 7.3.4.19)

Protection against loss of group synchronization safety function would reduce the probability of this hazardous event occurring.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

There are persons in the hazard zone and the load is not known. In the event of failure, serious permanent injury or death could be expected.

EN ISO 13849‑1	EN 62061
S2	Se4

Frequency and duration of exposure (F, Fr)

There is at least one show or more a day with more than 15 min exposure.

EN ISO 13849‑1	EN 62061
F2	Fr5

Possibility of avoiding the hazardous event (P, Av)

It is nearly impossible to avoid this hazardous event due to the high speed.

EN ISO 13849‑1	EN 62061
P2	Av5

Probability of the unwanted occurrence (Pr)

No reduction can be applied due to the constantly changing nature of the set-up.

EN ISO 13849‑1	EN 62061
Not low	Pr5

- 1. Safety function estimation – Annex E

Based on parameters S2, F2, P2, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLe.

Based on parameters Se4, Fr5, Av5 and Pr5, according to EN 62061 the required safety integrity level shall be at least SIL 3.

1. Chain hoist to fly a performer – protection against over-speed

G.5.1 Description

This example describes the use of the protection against over-speed safety function to reduce one of the hazards applicable to the chain hoist to fly a performer machine:

Use of a single chain hoist to fly a performer above the stage with actors underneath. The chain hoist has a maximum speed of 0,4 m/s. See Figure G.4.

Figure G.4 — Chain hoist to fly a performer

- 1. Use Case identification – Annex B

A single chain hoist is used to lift a performer.

Based on the intended use of the machine and the load configuration, the machine falls into UC5 (Moving person(s) suspended, no shared load).

- 1. Hazard definition – Annex A

Hazard Type:	Mechanical
Hazard Origin:	Approach of a moving element to a fixed part
Risk origin:	Unintentional movement due to mechanical failure
Hazardous event:	Unintended turning, tilting, hanging, falling, uncontrolled lowering
Hazard Consequences:	Crushing

- 1. Safety function allocation – Annex C

During a lifting operation, the motor torque/power fails, and it is not able to lift the load. The movement is uncontrolled, and it exceeds the expected speed.

Protection against over-speed safety function would reduce the probability of this hazardous event occurring.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

There are persons in the hazard zone. An unexpected movement could cause the fall of the performer or parts of the load. Serious permanent injury or death to the flying performer or the persons under the load could be expected.

EN ISO 13849‑1	EN 62061
S2	Se4

Frequency and duration of exposure (F, Fr)

There is at least one show or more a day with more than 15 min exposure.

EN ISO 13849‑1	EN 62061
F2	Fr5

Possibility of avoiding the hazardous event (P, Av)

The suspended performer cannot avoid the hazardous event.

EN ISO 13849‑1	EN 62061
P2	Av5

Probability of occurrence (Pr)

An electro-mechanical failure may occur. Skills and awareness of the operator will not be able to mitigate this unexpected event.

EN ISO 13849‑1	EN 62061
Not low	Pr5

- 1. Safety function estimation – Annex E

Based on parameters S2, F2, P2, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLe.

Based on parameters Se4, Fr5, Av5 and Pr5, according to EN 62061 the required safety integrity level shall be at least SIL 3.

1. Two winches to fly a performer – Protection against position deviation

G.6.1 Description

This example describes the use of the Protection against position deviation safety function to reduce one of the hazards applicable to the Two winches to fly a performer machine:

Use of two high speed winches to fly a performer. The winches have a maximum speed of 2 m/s. See Figure G.5.

Figure G.5 — Two winches to fly a performer

- 1. Use Case identification – Annex B

Two winches are used to fly a performer.

Based on the intended use of the machine and the load configuration, the machine falls into UC6 (Moving person(s) suspended, shared load).

- 1. Hazard definition – Annex A

Hazard Type:	Unintentional
Hazard Origin:	Unintentional movement
Risk origin:	Failure/malfunctioning of the control system
Hazardous event:	Synchronous travel is no longer ensured
Hazard Consequences:	Crushing

- 1. Safety function allocation – Annex C

During a flying performance, one of the motors is not moving as expected, the movement path exceeds the expected boundaries and limitations.

Protection against position deviation safety function would reduce the probability of this hazardous event occurring.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

There are persons in the hazard zone. Deviating from the expected path could cause the suspended performer to crush other performers or scenery. Serious permanent injury or death to the flying performer or the persons under the load could be expected.

EN ISO 13849‑1	EN 62061
S2	Se4

Frequency and duration of exposure (F, Fr)

There is more than one show per day. The duration of the act is less than 10 min. The combined day exposure is more than 15 min.

EN ISO 13849‑1	EN 62061
F2	Fr4

Possibility of avoiding the hazardous event (P, Av)

The flying performer cannot avoid the hazardous event.

EN ISO 13849‑1	EN 62061
P2	Av5

Probability of the unwanted occurrence (Pr)

A failure of the control system may occur. Skills and awareness of the operator will not be able to mitigate this unexpected event.

EN ISO 13849‑1	EN 62061
Not low	Pr5

- 1. Safety function estimation – Annex E

Based on parameters S2, F2, P2, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLe.

Based on parameters Se4, Fr4, Av5 and Pr5, according to EN 62061 the required safety integrity level shall be at least SIL 3.

1. Orchestra pit elevator – Protection against crushing/shearing

G.7.1 Description

This example describes the use of the Protection against crushing/shearing safety function to reduce one of the hazards applicable to the Orchestra pit elevator machine:

An elevator with no shared load and with a speed of 0,1 m/s is designed to lift goods as an orchestra pit elevator.

The orchestra lift platform creates a shearing-edge hazard between the platform and the ceiling of the lower storage/loading area when travelling in the up direction. See Figure G.6.

Key

1	control station	5	orchestra pit elevator
2	operator	6	auditorium
3	stage	7	shear edge
4	piano	8	storage area

Figure G.6 — Orchestra pit elevator

- 1. Use Case identification – Annex B

The elevator has no shared load and is designed to lift goods, shear edges are present. The maximum speed of the machine is 0,1 m/s.

Based on the intended use of the machine, the speed, shear edge condition and the load configuration, the machine falls into UC-LSL3 (No-one in hazard zone, Speed < 0,15 m/s, no shared load).

- 1. Hazard definition – Annex A

Hazard Type:	Mechanical
Hazard Origin:	Approach of a moving element to a fixed part
Risk Origin:	Incorrect Operation
Hazardous Event:	Tracking system travels to work position, persons stand in travel path
Hazard Consequences:	Cutting or severing

- 1. Safety function allocation – Annex C

During a lifting operation, when the platform is travelling in the up direction, body parts may protrude off the moving platform.

Protection against crushing/shearing safety function would reduce the probability of this hazardous event occurring.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

No-one should be on the lift platform, however there may be persons working near the pinching point. Serious permanent injury to workers may occur.

EN ISO 13849‑1	EN 62061
S2	Se4

Frequency and duration of exposure (F, Fr)

There is less than one operation every two weeks. The duration of exposure is less than 10 min.

EN ISO 13849‑1	EN 62061
F1	Fr2

Possibility of avoiding the hazardous event (P, Av)

The person exposed is aware of the hazard when in contact with the pinching point. At that point, avoidance might not be possible.

EN ISO 13849‑1	EN 62061
P2	Av3

Probability of the unwanted occurrence (Pr)

Although skills and training of the operator could avoid the occurrence of this event, the occurrence of this hazardous event in the industry is common.

EN ISO 13849‑1	EN 62061
Not low	Pr5

- 1. Safety function estimation – Annex E

Based on parameters S2, F1, P2, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLd.

Based on parameters Se4, Fr2, Av3 and Pr5, according to EN 62061 the required safety integrity level shall be at least SIL 2.

1. Stage elevator platform – Protection against overload

G.8.1 Description

This example describes the use of the Protection against overload safety function to reduce one of the hazards applicable to the Stage elevator platform machine:

The elevator has no shared load, and it is designed moving actors during artistic performances and rehearsals. At the stage level, the elevator can be loaded with a higher load than the lifting capacity when in suspension (ELL/R). The machine is installed in a busy opera-house which is expected to have 1 to 2 rehearsals during the day and a performance in the evening. See Figure G.7.

Key

1	stage	4	motor
2	elevator platform	5	brakes
3	load cells

Figure G.7 — Stage elevator platform

- 1. Use Case identification – Annex B

The elevator has no shared load and is designed to lift performers.

Based on the intended use of the machine and the load configuration, the machine falls into UC-LSL5 (Person(s) in hazard zone, no shared load).

- 1. Hazard definition – Annex A

Hazard Type:	Mechanical
Hazard Origin:	Instability
Risk origin:	Incorrect loading, overloading, exceeding specified overturning moments
Hazardous event:	Overload shut-off incorrectly adjusted or not functioning properly and the lifting mechanism is overloaded.
Hazard Consequences:	Drawing-in or trapping

- 1. Safety function allocation – Annex C

If the maximal permitted characteristic load is exceeded a collapse of the elevator can be the result when opening the brakes.

Protection against overload safety function would reduce the probability of this hazardous event occurring.

- 1. Initial risk estimation – Annex F

Severity (S, Se)

There may be persons in the hazard zone. On failure of the lifting machine, persons could get trapped between the platform and the load. Serious permanent injury or death to the performer on the lift platform could be expected.

EN ISO 13849‑1	EN 62061
S2	Se4

Frequency and duration (F, Fr)

The machine operates more than once a day, the lifting operation takes less than 10 min. The combined day exposure is more than 15 min.

EN ISO 13849‑1	EN 62061
F2	Fr5

Possibility of avoiding the hazardous event (P, Av)

The person on the lift will not be able to avoid the hazard.

EN ISO 13849‑1	EN 62061
P2	Av5

Probability of the unwanted occurrence (Pr)

A failure of the lifting mechanism may occur. Skills and awareness will not be able to mitigate this unexpected event.

EN ISO 13849‑1	EN 62061
Not low	Pr5

- 1. Safety function estimation – Annex E

Based on parameters S2, F2, P2, and the occurrence not low, according to EN ISO 13849‑1 the required performance level shall be at least PLe.

Based on parameters Se4, Fr5, Av5 and Pr5, according to EN 62061 the required safety integrity level shall be at least SIL 3.

(informative)

Guidelines for the evaluation of exceptional loads occurring during vertical movement
1. General

This Annex takes care on exceptional loads only. Calculations regarding normal operating conditions shall be carried out according to recognized engineering techniques.

For the calculation of exceptional loads reference to EN 13001-2 is recommended.

Design should be extended to exceptional conditions as applicable to the specific machine being analysed.

For possible exceptional conditions, see 3.2.6.

In particular, reference is made to a special case resulting from the fact that extremely high loads and deceleration may occur in the event of a fault (Stop category 0 according to EN 60204-1).

Effects of exceptional conditions may be assessed by calculation, which may be supported by simulation and measurement.

In the case of exceptional loads associated with acceleration/deceleration of the machine, the resulting inertial forces shall also be taken into account. As a rigid body analysis does not reflect elastic effects, these shall be determined separately.

1. Calculation of exceptional loads
  1. Calculation with dynamic factor

When a rigid body kinetic model is used in the analysis, load effects determined with this approach should be properly factored to account for elastic effects.

For the calculation of the peak values of the load actions the concepts of EN 13001-2 may be used. In this case, the peak values of the load actions are calculated from the results of the rigid body analysis. To determine the peak load of a hoist, see the example in H.4.2.

The calculation method with a dynamic factor is only applicable if no slack rope may occur during movement. For example, large decelerations during fast lifting movements may cause the rope to become slack and the load to subsequently free fall into the standing rope. This may lead to exceptionally large deceleration peaks. In this case, simulations may be necessary.

- 1. Calculation via simulation

If the payload is suspended on elastic elements such as ropes, it is only possible to calculate the loads and decelerations precisely with complex analysis as there exist many influencing parameters, especially:

a) mass of the load;

b) mass moment of inertia of the drive system;

c) braking torque;

d) brake connection time and braking torque rise time;

e) spring stiffness of the load bearing elements (in case of ropes: free rope length, E-modulus, cross-sectional area);

f) additional masses, if applicable;

g) additional elastic support-elements, if applicable.

The above factors are normally only known approximately or are subject to large variations. In order to estimate the worst-case condition, the above parameters should be properly selected within the applicable tolerances.

1. Measuring the effects of the exceptional load

When acceleration measurements are used to calculate the load actions, the relevant acceleration peak should be determined by a suitable statistical evaluation based on several measurements. Guidance on this can be found, for example, in EN 1990:2023, Annex D - Design assisted by testing.

Load actions and accelerations are significantly affected by the braking torque. In case of measurements, suitable measures should be taken to ensure that the effective braking torque corresponds to the maximum braking torque.

1. Example
  1. General

The following example is intended to provide guidance in the evaluation of the exceptional loading conditions.

- 1. Cat. 0 stop when lifting and lowering a load

For the calculation of the peak values of the load actions, the concept of EN 13001-2:2021, 4.2.2.5 can be used. In this case, the peak values of the load actions are calculated from the results of the rigid body analysis using the coefficient ϕ₅, the dynamic factor for loads caused by acceleration.

The value ϕ₅ = 2 is recommended to ensure that the approximate calculation provides sufficient dimensioning of the drive system.

In the case of using ropes as load-bearing elements, it shall be ensured that they do not become slack. Should slack rope occur during movement, the method with dynamic factors is no longer applicable. See Figure H.1.


a) from steady state	b) in the event of braking

Figure H.1 — Change in driving forces

where

	is the maximal load effect
	is the change of the load effect due to the change of the drive force ;
	are the initial (i) and final (f) load effects caused by and ;
	are the initial (i) and final (f) drive forces.

[SOURCE: EN 13001-2:2021, 4.2.2.5]

[The figures are based on EN 13001-2:2021, 4.2.2.5, they are mirrored and shortened by one oscillation so that they better match a typical braking process of a lowering movement. Additionally, indices have been added for references in the example.]

The Cat. 0 stop process consists of the dropout of the motor torque and temporally delayed, the rise of the braking torque. First the drop out of the motor torque and afterwards the engagement of the brakes is considered to stimulate the oscillation:

Drop out of the motor torque:

where

	is acceleration during drop out of the motor torque and connection time of brakes;
	is load hanging on the ropes.

Impact of the brakes:

where

is deceleration during impact of the brakes.

(informative)

Partial Safety Factors and Design Risk Factors

NOTE Verification according to standards based on the limit state concept.

1. Partial safety factors

The text of EN 17206 is based on the overall safety concept commonly used in mechanical engineering (allowable strength/stress design). This means that the formula given assume that all safety factors are taken into account in the permissible values.

If the limit state concept (load and resistance factor design, limit state design) is used for the verification of components, then the safety factors shall already be taken into account with the loads. This is the case, for example, if the verification is carried out in accordance with the Eurocode (e.g. EN 1993 series) or the crane standard (EN 13001 series).

With regard to the application of the partial safety factors in a verification according to the limit state concept, see an adapted version of Table 1 in 3.2.

1. Risk coefficient

EN 17206 defines the basic safety concept in Chapter 5, for example, as doubling the characteristic load. This effectively doubles the safety factor in the verifications.

The crane standard defines a risk coefficient as additional safety for high-risk situations (EN 13001‑2:2021, 4.3.2). In comparison with EN 17206, this corresponds to doubling the characteristic load or a risk coefficient = 2 for loads and forces in normal operation (or risk coefficient = 1 for exceptional loads and forces).

1. Adapted version of Table 1 with partial safety factors and risk coefficient

Adapted Table 1 – Loads and forces:

psf = partial safety factor

rc = risk coefficient

Loads and forces in normal operation:

Entertainment Load Limit (ELL) × psf_a

+ weight of load carrying device × psf_b

= system load

+ dynamic forces × psf_c

= characteristic load

× rc_a = design load

Loads and forces in exceptional condition:

Entertainment Load Limit (ELL) × psf_d

+ weight of load carrying device × psf_e

= system load

+ dynamic forces during exceptional conditions × psf_f

= exceptional load

× rc_b = design load

NOTE 1 The partial safety factors psf are defined in the relevant proof/verification standard.

NOTE 2 The risk coefficient rc is in general 2 x loads and forces in normal operation and 1 x loads and forces in exceptional conditions. Exceptions are described in Clause 5.

NOTE 3 The definitions of "characteristic loads" contained in EN 17206, in Eurocodes EN 1990 to EN 1999, and in EN 13001 differ.

EN 17206 uses the definition from 3.2.1 of this document, whilst the Eurocode and the crane standard have their own definitions.

Care shall therefore be taken to use the appropriate definition in each case.

Bibliography

[1] EN 795, Personal fall protection equipment — Anchor devices

[2] EN 1570‑1, Safety requirements for lifting tables — Part 1: Lifting tables serving up to two fixed landings

[3] EN 1570‑2, Safety requirements for lifting tables — Part 2: Lifting tables serving more than 2 fixed landings of a building, for lifting goods with a vertical travel speed not exceeding 0,15 m/s

[4] EN 13001-2, Crane safety - General design - Part 2: Load actions

[5] EN ISO 14118, Safety of machinery. Prevention of unexpected start-up (ISO 14118)

[6] EN 17115, Entertainment technology — Specifications for design and manufacture of aluminium and steel trusses

[7] EN 60204‑11:2019, Safety of machinery — Electrical equipment of machines — Part 11: Requirements for equipment for voltages above 1 000 V AC or 1 500 V DC and not exceeding 36 kV (IEC 60204‑11:2018)

[8] EN 61131‑1, Programmable controllers — Part 1: General information (IEC 61131‑1)

[9] EN 61131‑2, Programmable controllers — Part 2: Equipment requirements and tests (IEC 61131‑2)

[10] EN IEC 61496‑1, Safety of machinery — Electro-sensitive protective equipment — Part 1: General requirements and tests (IEC 61496-1)

[11] EN 61984:2009, Connectors — Safety requirements and tests (IEC 61984)

[12] EN ISO 4413, Hydraulic fluid power — General rules and safety requirements for systems and their components (ISO 4413)

[13] EN ISO 4414, Pneumatic fluid power — General rules and safety requirements for systems and their components (ISO 4414)

[14] EN ISO 13856‑1, Safety of machinery — Pressure-sensitive protective devices — Part 1: General principles for design and testing of pressure-sensitive mats and pressure-sensitive floors (ISO 13856-1)

[15] EN ISO 14119, Safety of machinery — Interlocking devices associated with guards - Principles for design and selection (ISO 14119)

[16] EN ISO 14120, Safety of machinery — Guards — General requirements for the design and construction of fixed and movable guards (ISO 14120)

[17] EN ISO 14122 (all parts), Safety of machinery — Permanent means of access to machinery (ISO 14122 (all parts))

[18] EN ISO 3834‑1, Quality requirements for fusion welding of metallic materials — Part 1: Criteria for the selection of the appropriate level of quality requirements (ISO 3834-1)

[19] ISO 4301‑1, Cranes — Classification — Part 1: General

[20] ISO 4301‑2, Cranes — Classification — Part 2: Mobile cranes

[21] IEV. International Electrotechnical Vocabulary available at https://www.electropedia.org/

[22] EN 12385‑1, Steel wire ropes — Safety — Part 1: General requirements

[23] EN 12385‑2, Steel wire ropes — Safety — Part 2: Definitions, designation and classification

[24] EN 12385‑5, Steel wire ropes — Safety — Part 5: Stranded ropes for lifts

Table of Contents

1.0 Scope

2.0 Normative references

3.0 Terms and definitions

3.1 General terms

3.1.1 Loads, forces and pressures

3.1.2 Electrical equipment and control systems

3.1.3 Tolerances relating to movement

4.0 Hazards

4.1 General

4.1.1 List of significant hazards

5.0 Design requirements

5.1 General

5.1.1 Examples of machine installations showing the groups

5.1.2 Additional load assumptions

5.1.3 Load assumptions for stage elevators

5.1.4 Load assumptions for stage wagons and turntables

5.2 Load bearing equipment

5.2.1 General

5.2.2 Load bearing lines

Wire ropes

Chains

5.2.3 Load bearing lines terminations

Wire rope terminations

Detachable wire rope terminations

Fixed or Non-detachable wire rope terminations

Load Hooks

End connections for steel chains

5.3 Winding devices and diverter pulleys

5.3.1 Winding devices for wire ropes

5.3.2 Diverter pulleys for round wire ropes

5.3.3 Drive and idler sprockets for steel chains

5.3.4 Traction sheaves

5.4 Drive systems

5.4.1 General

5.4.2 Load securing devices

5.4.3 Couplings

5.4.4 Direct Acting Rated Capacity Limiters

5.4.5 Screw jack systems (spindle drives)

5.4.6 Hydraulic systems

5.4.7 Auxiliary drive systems

5.4.8 Manually powered systems

5.4.9 Manual performer flying systems

General

Fibre ropes for manual performer flying systems

Operator lines and travel ropes

Pulleys, block-systems, sheaves and drums

Track systems and trolleys

5.4.10 Load holding devices for stage elevators

5.5 Load carrying devices

6.0 Safeguarding hazardous areas

6.1 Protective spaces for inspection and maintenance

6.1.1 Accessibility of maintenance areas

6.1.2 Safeguarding at crushing, shearing and trapping points, and fall protection

6.1.3 Elevator shaft walls, openings and landing doors

6.1.4 General

6.1.5 Interlocking of doors

6.2 Counterweights

7.0 Electrical equipment and control systems

7.1 General requirements

7.1.1 General

7.1.2 Selection of equipment

7.1.3 Physical environment and operation conditions

Electromagnetic compatibility (EMC)

Ambient air temperature and humidity

7.2 Incoming supply conductor terminations and devices for disconnecting and switching off

7.2.1 Electric motors and associated equipment

7.2.2 Protection against electric shock

7.2.3 Protection of equipment

General

Protection under fault conditions

Cutting off power

7.2.4 Control circuits and control functions

General

Control devices

Enabling devices

Cable-less control devices

7.2.5 Travel of groups of machines

General

Travel of several groups