<section aria-labelledby="intro">
    <h2 id="intro">Why service modes deserve management attention</h2>
    Elevators are often treated as familiar conveniences until one behaves differently from normal. A car may stop accepting hall calls, remain at a designated floor, respond only from inside, or display a message that is not part of ordinary passenger service. These behaviors are not random features. They may represent a defined service mode intended for inspection, emergency response, controlled access, construction support, independent use, or another purpose established by the equipment design and the governing code. Each mode changes the relationship between the car, its doors, its call system, the supervisory controls, and the people responsible for the building.
    For commercial building maintenance, the important question is not simply what a switch or indicator is called. The important question is who may authorize a change, under what conditions, with which precautions, and how the building returns to normal operation. Those decisions touch life safety, accessibility, security, business continuity, insurance, labor boundaries, and regulatory compliance. A technically possible action may still be prohibited for a property employee. A mode that is appropriate during a fire-service response may be dangerous or unlawful as a workaround for a routine fault.
    This guide explains service modes from a management and coordination perspective. It deliberately avoids procedures for defeating interlocks, accessing locked controls, changing protected settings, or operating a restricted mode without authority. Equipment varies by manufacturer, model, modernization history, jurisdiction, and site configuration. Labels that sound similar can behave differently. Building personnel should therefore use approved site documentation, the current maintenance control program, applicable codes, and instructions from the licensed elevator contractor or authority having jurisdiction. When those sources conflict or appear incomplete, the safe response is to stop, isolate the issue administratively, and obtain qualified direction.
  </section>

  <section aria-labelledby="system">
    <h2 id="system">The elevator as a managed building system</h2>
    A commercial elevator is not an isolated appliance. It is a regulated transportation system integrated with electrical distribution, fire detection, emergency power, communications, access control, ventilation, and building operations. Its safe behavior depends on mechanical equipment, control software, landing fixtures, door protection devices, hoistway components, machine or control spaces, and human procedures. Service modes sit within that network. A command originating at a lobby panel, protected switch, fire alarm interface, supervisory station, or car operating panel can affect several systems at once.
    This systems view prevents a common maintenance error: assuming that an elevator problem can be solved by changing its operating state. If hall calls are unanswered, the root cause might be a door fault, a protective device, a power problem, a fire alarm input, a dispatching issue, scheduled maintenance, or a deliberate security arrangement. Selecting another mode may conceal evidence, introduce a new hazard, or make the car unavailable to people who rely on it. Diagnosis belongs to qualified personnel using authorized methods, not to trial-and-error operation by staff.
    Property teams should manage elevator availability in the same disciplined way they manage fire pumps, generators, smoke control, and other critical assets. That means defined ownership, controlled access, current records, planned tests, competent vendors, clear escalation paths, and documented restoration. The objective is not maximum movement at every moment. The objective is safe, compliant, predictable service, with deviations controlled and communicated. This distinction matters during pressure from tenants, deliveries, events, or senior management. Operational urgency never converts an unauthorized action into an acceptable one.
  </section>

  <section aria-labelledby="taxonomy">
    <h2 id="taxonomy">A functional map of common service states</h2>
    Terminology differs, but service states can be understood by their purpose. Normal automatic operation accepts calls according to the elevator group’s dispatch logic. Independent or reserved service may remove a car from group dispatch so an authorized person can control destinations from within the car. Attendant arrangements, where provided, support supervised passenger operation. Inspection operation is a restricted maintenance state used by qualified elevator personnel for examination, testing, adjustment, or movement associated with technical work. Firefighters’ emergency operation supports recall and subsequent firefighter control in accordance with the equipment design and applicable code.
    Other states may support emergency power sequencing, hospital or medical priority, security lockdown, VIP or tenant reservation, Sabbath operation, freight handling, construction use, evacuation strategies, or special accessibility functions. Some are true modes selected through dedicated controls. Others are responses to external signals or programmed dispatch features. A car marked “out of service” may be disabled by a fault rather than intentionally placed into a service mode. The visible passenger experience alone does not reveal the cause.
    Managers should resist building a universal cheat sheet based only on names. Instead, maintain an equipment-specific mode register. For every installed function, record its official name, operational purpose, initiating authority, authorized user class, expected passenger impact, related building interfaces, notification requirements, restoration authority, and the source document that confirms those facts. The register should not contain protected access details or step-by-step instructions that broaden capability beyond assigned roles. It is a governance reference, not an operating manual for restricted functions.
    <div class="note"><strong>Core principle:</strong> recognize the purpose and impact of a service state, but leave protected operation, testing, adjustment, and fault diagnosis to people whose authorization and competence match the task.</div>
  </section>

  <section aria-labelledby="normal">
    <h2 id="normal">Normal operation and the meaning of abnormal behavior</h2>
    Normal passenger service is the baseline against which every exception is assessed. In normal operation, passengers place hall calls, enter when the car arrives, choose permitted destinations, and rely on automatic door and dispatch functions. Even this familiar state includes controlled behaviors such as access restrictions, destination dispatch assignments, peak traffic strategies, and programmed parking. Facilities teams need to know the building’s intended baseline so that a configuration choice is not mistaken for a defect and a defect is not dismissed as a configuration choice.
    Abnormal behavior should be described in observations rather than conclusions. “The east car did not respond to three lobby calls between 09:10 and 09:16” is more useful than “the elevator went into service mode.” Note the car identifier, floor, time, displayed message, audible announcement, door position, whether passengers are present, and whether fire alarms, power events, water incidents, or contractor activity are occurring. Do not repeatedly call the car, obstruct doors, force panels, or experiment with controls. Preserve the scene and the sequence of events.
    A first-line building response usually consists of protecting people, checking approved supervisory information, confirming whether work or testing is scheduled, and contacting the designated elevator service provider or emergency channel. If there is smoke, fire, entrapment, injury, water entering elevator areas, unusual noise, burning odor, uncontrolled movement, or another immediate hazard, follow the site emergency plan and call the appropriate emergency service. The goal is rapid escalation with accurate facts, not amateur diagnosis. A concise factual report helps qualified responders choose the right resources and reduces the temptation for others to improvise.
  </section>

  <section aria-labelledby="roles">
    <h2 id="roles">Roles and boundaries of authority</h2>
    <h3>Owners and asset managers</h3>
    The owner or responsible asset manager carries the broad duty to provide a compliant installation, contract competent maintenance, arrange required inspections, correct cited deficiencies, and maintain records. Ownership should establish the policy that restricted controls are used only by authorized people for their intended purpose. It should also fund realistic coverage. A policy that requires contractor attendance is ineffective if the contract provides no reliable response outside office hours.
    <h3>Property and facilities managers</h3>
    Property managers translate those duties into daily coordination. They maintain vendor contacts, verify credentials, control work permits and keys, plan outages, communicate with tenants, and ensure that a car is not returned to passenger use before release by the proper authority. They may acknowledge an alarm or implement an approved building response, but managerial responsibility does not automatically confer technical authority. Their most valuable skill is often knowing exactly where their boundary lies.
    <h3>Building engineers and maintenance staff</h3>
    In-house engineers monitor conditions, perform tasks expressly assigned by policy and law, and support contractors with access to building systems. Their general electrical or mechanical experience does not replace elevator-specific licensing where licensing is required. They should never enter a hoistway, pit, car top, machine space, or protected control area unless the task, training, authorization, access arrangement, and safety program explicitly permit it.
    <h3>Licensed elevator personnel and inspectors</h3>
    Qualified elevator mechanics, technicians, and inspectors carry out work within their legal and contractual scope. They use service modes for defined technical purposes, establish safe work zones, apply energy-control procedures, conduct tests, document results, and communicate equipment status. Inspectors and the authority having jurisdiction independently verify compliance as required. Building staff should support their access and information needs without interfering with their control of the work.
    <h3>Security, reception, and occupants</h3>
    Security and reception teams are often the first to receive a passenger report. Their role is to reassure, gather essential facts, secure affected landings, route calls, and activate the emergency plan. Occupants, tenants, delivery teams, and event organizers need clear alternatives and must respect barriers and signs. None should be given protected keys, codes, or operating instructions merely for convenience. Access privileges must follow documented need, training, and formal authorization.
  </section>

  <section aria-labelledby="authorization">
    <h2 id="authorization">Authorization is more than possession of a key</h2>
    A key, credential, or accessible switch does not prove that its holder is authorized to use a function. Authorization combines organizational permission, legal eligibility, task-specific competence, current training, and a valid operational reason. It may also require dispatch from an elevator contractor, approval from building management, coordination with fire command, or the presence of a second qualified person. The exact combination depends on the mode and jurisdiction.
    Good access governance starts with a role-based matrix. The matrix identifies who may request a mode, who may approve it, who may operate it, who must be notified, and who may confirm restoration. High-consequence functions should not depend on informal custom such as “the night supervisor knows where the key is.” Key inventories should identify custody without publishing sensitive keying information. Electronic access logs, sealed key cabinets, sign-out records, and periodic audits can support accountability, but administrative controls cannot compensate for unauthorized technical work.
    Temporary staff and contractors deserve special attention. A general construction contractor may need elevator support but should not receive unrestricted elevator control. The property manager and elevator contractor should agree on the required service arrangement, load limits, protective measures, schedule, and supervision. Similarly, a tenant request for an exclusive car should be handled through an approved reservation process, not by showing tenant employees how to activate a control. Clear boundaries protect the equipment, the public, and the requester from preventable liability.
  </section>

  <section aria-labelledby="independent">
    <h2 id="independent">Independent, reserved, and attendant service</h2>
    Independent service, where installed, generally removes a car from ordinary group response and allows destinations to be managed from within the car. Buildings may use such an arrangement for controlled moves, events, sensitive materials, accessibility assistance, or other approved purposes. Its operational effects can be significant: waiting passengers may see fewer available cars, automated dispatch assumptions may change, and the reserved car may no longer answer ordinary hall calls. The property must therefore evaluate traffic demand and accessibility before approving use.
    Reserved service is not a substitute for freight procedures or a remedy for a malfunction. Before an authorized use, management should confirm that the intended load is permitted, that floor protection and padding do not obstruct safety devices, that corridors remain clear, and that a trained responsible person will supervise the move. Materials must not exceed rated capacity or dimensions, compromise egress, damage entrances, or create contamination and spill hazards. Local rules may restrict transport of certain chemicals, gases, waste, animals, or construction materials.
    Attendant service, if the installation supports it, assigns operational responsibility to a trained attendant within a defined policy. That person is not an elevator mechanic and must not troubleshoot protected systems. The attendant manages passenger movement, follows capacity and door-safety rules, watches for abnormal conditions, and reports faults. Any irregular response should end the planned use and trigger escalation. The building must also define relief, communication, accessibility assistance, and what happens if an alarm, fire signal, power disturbance, or medical emergency occurs during the reservation.
  </section>

  <section aria-labelledby="inspection-mode">
    <h2 id="inspection-mode">Inspection operation and technical service states</h2>
    Inspection operation is a restricted technical condition associated with examination, maintenance, adjustment, and testing. It changes ordinary automatic behavior so qualified elevator personnel can control movement for specific work. Its presence in a building does not make it a facilities tool. Misuse can expose people to crushing, fall, electrical, and unexpected-movement hazards, particularly near the car top, pit, hoistway, entrances, and machinery. Only appropriately qualified and authorized personnel should establish, use, or clear this state.
    Building management’s role is to create the conditions for safe technical work. That includes verifying the contractor’s identity and dispatch, coordinating access, disclosing known building hazards, controlling nearby public areas, sharing information about alarms or emergency power tests, and ensuring that other contractors do not interfere. The elevator professional controls the technical work zone and determines the equipment status. Property staff should not request shortcuts because a lobby is busy or a tenant is impatient.
    When work ends, restoration must be positive rather than assumed. The responsible elevator professional should account for personnel and tools, remove protections under their control, verify required components and spaces, test the installation as appropriate, and communicate whether the elevator is released for normal passenger service. Building management then removes administrative barriers, updates logs, and communicates availability. If the technician leaves a car out of service pending parts, inspection, or further testing, no one else should attempt to restore it. The written status should identify the restriction, responsible contact, and next review point without exposing protected technical details.
  </section>

  <section aria-labelledby="fire">
    <h2 id="fire">Firefighters’ emergency operation and recall</h2>
    Firefighters’ emergency operation is a life-safety function, not a general-purpose override. Depending on the applicable code and system design, an alarm or authorized command may recall cars to a designated or alternate level, prevent ordinary passenger use, and make a car available for controlled use by firefighters. The sequence interacts with fire alarm initiating devices, emergency power, lobby conditions, indicators, and communications. Building employees should understand the public-facing implications but must not attempt to simulate or use firefighter control without authorization.
    During a fire alarm, staff follow the building emergency plan. They direct occupants to approved egress routes, keep elevator lobbies clear, provide information to emergency responders, and avoid contradicting displayed or announced instructions. They do not use an elevator simply because a car is present with open doors. Accessibility and assisted-evacuation provisions must be planned in advance; they cannot rely on spontaneous use of a recalled elevator. Buildings with occupant evacuation elevators or other specialized strategies require equipment-specific procedures, trained personnel, and close alignment with the approved fire safety plan.
    After an alarm, silencing or resetting another system does not automatically establish that elevators are ready for public use. Fire service states, water exposure, smoke conditions, emergency power transfers, and responder actions may require inspection or reset by designated personnel. The incident commander, fire alarm provider, elevator contractor, and building management have distinct roles. The property should document who has authority to release each affected system. When there is uncertainty, keep the elevator administratively unavailable and obtain confirmation rather than relying on the absence of an alarm sound.
  </section>

  <section aria-labelledby="power">
    <h2 id="power">Emergency power and recovery from electrical events</h2>
    Many commercial buildings connect selected elevators to standby or emergency power. Capacity may be sufficient for only one car at a time, requiring automatic or manual sequencing under an approved design. A transfer can produce pauses, recall behavior, staged availability, or supervisory indications that differ from normal utility operation. Facilities teams should know the approved emergency-power strategy, the cars included, priority arrangements, fuel-duration assumptions, and dependencies such as cooling, controls, communications, and fire alarm interfaces.
    Generator testing must be coordinated with the elevator contractor when required by the maintenance program or local rules. A successful generator start alone does not prove successful elevator operation. Tests should verify the intended sequence and record observed performance without placing untrained staff in restricted roles. Planned testing also needs occupant notices, accessibility arrangements, security support, and a stop condition for unexpected behavior. Sensitive tenant operations may require scheduling, but safety objectives should not be diluted to avoid inconvenience.
    Following an outage, brownout, surge, or transfer anomaly, personnel should avoid repeatedly cycling power or using service controls in an effort to recover a car. Repeated resets can obscure a fault and create unplanned movement or entrapment risk. Report the event, preserve relevant building-management and generator logs, identify affected cars, and obtain qualified assessment. If passengers are trapped, use the established entrapment response. Restoration should consider not only whether a car moves, but whether doors, leveling, dispatch, alarms, communications, emergency power, and related safety functions have returned to their verified state.
  </section>

  <section aria-labelledby="security">
    <h2 id="security">Security and access-control integrations</h2>
    Elevators frequently participate in a building’s access-control strategy. Credentials may permit selected floors, destination-dispatch kiosks may assign cars based on identity, and security systems may restrict service after hours. These are legitimate operational features, but they can complicate diagnosis. A passenger who cannot select a floor may have an expired credential, a tenancy configuration issue, a network problem, or an elevator fault. Security and elevator teams should share a clear triage boundary so neither changes the other’s system without coordination.
    Security lockdown functions require particular discipline. They should be tied to an approved threat plan, not activated casually in response to uncertainty. Restricting elevator movement can redirect people into stairs, prevent accessibility, separate occupants, affect responder access, and produce crowding. The decision authority, scope, duration, communication method, and restoration criteria must be defined before an incident. Emergency responders retain authority appropriate to the event, and life-safety functions take precedence over routine security convenience.
    Logs can help reconstruct what happened, but they must be handled according to privacy, cybersecurity, and retention policies. Preserve relevant timestamps across access control, video, elevator monitoring, fire alarm, and building automation systems. Avoid circulating screenshots that expose personal information or security configuration. Vendor remote access should use approved accounts, least privilege, multifactor controls where supported, and documented support channels. A maintenance request is not a reason to disclose master credentials or leave a protected session unattended.
  </section>

  <section aria-labelledby="safety">
    <h2 id="safety">Foundational safety controls</h2>
    The strongest elevator safety programs begin before anyone touches equipment. Work is planned, roles are assigned, hazards are assessed, the public is separated from work areas, and communication methods are tested. Qualified personnel decide which energy-control, access, barricade, fall-protection, electrical-safety, or rescue provisions apply. Building management supports those controls by preventing conflicting work, maintaining clear routes, and enforcing boundaries around landings and technical spaces.
    Doorways deserve constant attention because people naturally approach an elevator expecting a floor behind the doors and a car at the landing. Never defeat door locks, pry doors, reach through openings, or assume that a car remains where it was last seen. Temporary barriers must be substantial, visible, accessible, and appropriate to the hazard. A handwritten note on a door is not a sufficient barrier to a hazardous opening. If an entrance appears damaged, unsecured, or open without a safely positioned car, keep people away and call emergency services and the elevator contractor according to the site plan.
    Water is another critical hazard. Leaks, sprinkler discharge, flooding, and wet cleaning near entrances can reach electrical or hoistway equipment. Staff should protect the area, stop the source when safely possible under their ordinary duties, and escalate promptly. They should not send a car to “check” a wet lower level or enter a pit to inspect water. Smoke, burning odors, unusual heat, grinding sounds, repeated door impacts, misleveling, and unexpected movement likewise demand removal from public use and qualified assessment.
    Housekeeping supports safety but must respect equipment boundaries. Keep elevator lobbies, machine-room approaches, control spaces, and rescue access paths clear. Do not store supplies in restricted rooms. Do not attach decorations, signs, cables, or protective coverings in ways that interfere with fixtures, vision panels, sensors, ventilation, or doors. A clean and orderly environment makes anomalies easier to see and gives responders faster access when time matters.
  </section>

  <section aria-labelledby="compliance">
    <h2 id="compliance">Compliance framework and the authority having jurisdiction</h2>
    Elevator compliance arises from a layered framework. National or model codes may be adopted with local amendments. Building, fire, electrical, accessibility, occupational safety, and elevator-specific rules may all apply. The authority having jurisdiction may be a municipal department, state or provincial agency, labor body, fire authority, third-party inspection organization, or a combination. Contract requirements and manufacturer instructions add obligations but do not replace law.
    Because requirements vary, a responsible owner maintains a jurisdictional register rather than relying on generic internet advice. The register identifies permits, certificates, inspection frequencies, test intervals, reporting deadlines, posting requirements, responsible parties, and the official sources used. It should be reviewed after code adoption, modernization, ownership change, major incident, or notice from the authority. Legal counsel or a qualified consultant may be appropriate for complex portfolios, but the operating team still needs a practical summary of duties.
    Compliance is not satisfied by passing an annual visit while daily controls remain weak. Expired certificates, unresolved deficiencies, inaccessible machine spaces, missing communication tests, uncontrolled keys, poor records, or unauthorized alterations can create exposure even when cars appear to run normally. Conversely, a shutdown ordered by an inspector or qualified mechanic must be respected. Business impact does not authorize temporary operation unless the competent authority has expressly approved a defined arrangement.
    Accessibility obligations require special care whenever service changes. An outage may remove the only practical route to a floor. Management should identify affected occupants and services without demanding unnecessary medical disclosure, provide reasonable alternatives, communicate expected duration, and prioritize restoration. Temporary routes must be genuinely usable, not merely theoretical. Accessibility planning should be integrated with outage permits, event plans, emergency procedures, and tenant communications.
  </section>

  <section aria-labelledby="mcp">
    <h2 id="mcp">Maintenance control, records, and configuration integrity</h2>
    A maintenance control program organizes the procedures, intervals, examinations, tests, and records needed for the specific equipment. Its form and mandatory content depend on the jurisdiction, but its management value is universal. It gives the owner and contractor a shared framework for planned care instead of relying solely on breakdown calls. Service-mode functions, emergency operations, communications, door systems, and interfaces should be addressed according to applicable requirements and equipment design.
    Records should show what was done, by whom, when, under what authorization, what condition was found, what corrective action followed, and whether the unit returned to service. Entries must be factual and legible. “Fixed elevator” is inadequate; equally, a building log should not attempt to reproduce proprietary technical procedures. Reference the contractor’s work order, test report, inspection record, or deficiency number. Maintain retention and availability in the form required by the authority.
    Configuration integrity matters after modernization, software updates, fire alarm work, generator replacement, access-control changes, or tenant fit-outs. Interfaces can fail even when each contractor believes its own system is functioning. Change management should identify affected systems, assign an integration owner, define acceptance tests, preserve approved settings, and update drawings and narratives. No one should alter a protected parameter merely to make a test pass. Unexpected results require investigation against the approved design.
    Remote monitoring can improve response by reporting faults, usage, or availability, but it does not replace onsite verification or statutory inspection. Alerts need ownership, severity rules, tested routing, and escalation. Too many low-value alerts produce fatigue; missing context produces unnecessary dispatches. Monitoring data should be time-synchronized and protected from unauthorized access. Any remote command capability should be narrowly controlled and approved, with auditable actions and a clear prohibition against using it to bypass a safety condition.
  </section>

  <section aria-labelledby="inspection">
    <h2 id="inspection">Inspection and testing governance</h2>
    Routine observation by building staff, preventive maintenance by the service contractor, periodic tests, and regulatory inspections are related but distinct activities. A daily or weekly walkthrough can identify damaged fixtures, poor leveling, unusual noise, failed lighting, wet landings, obstructed access, or a nonworking communication device. It does not replace a technical examination. Staff check only items within their training and without entering restricted spaces or activating protected modes.
    Before a formal test or inspection, the property manager should confirm scope, date, participating organizations, expected outages, emergency-power needs, fire alarm coordination, security access, and tenant impact. Documentation should be ready, not reconstructed while an inspector waits. If testing may create alarms or recall behavior, notification and impairment procedures must prevent false emergency response while preserving real protection. The responsible parties define how the system will be returned from test status.
    Deficiencies need risk-based closure. The report should identify the affected unit or component, requirement, due date, interim restriction, responsible owner, contractor action, evidence of completion, and verification method. A spreadsheet entry marked “sent to vendor” is not closure. Where continued operation is permitted with conditions, those conditions must be understood by every shift and removed only by the authorized party. Where operation is prohibited, the car remains secured against public use.
    Trend review adds value beyond individual findings. Repeated door callbacks at one landing, recurring emergency telephone failures, intermittent recall faults, or multiple power-transfer incidents may indicate a systemic issue. Review callback categories, downtime, repeat visits, parts delays, entrapments, inspection findings, and tenant complaints. Use the evidence to improve maintenance scope, capital planning, staff training, and vendor performance discussions. Avoid incentives that reward quick closure while encouraging superficial resets.
  </section>

  <section aria-labelledby="communication">
    <h2 id="communication">Communication before, during, and after an outage</h2>
    Clear communication is a safety control. Before planned work, notices should state which elevators or floors are affected, the start window, realistic expected duration, available alternatives, accessibility contact, delivery restrictions, and where updates will appear. Avoid promising a precise restoration time when parts, testing, or inspection could change it. Tenant coordinators, security, cleaning, loading dock teams, event staff, and emergency planners may need different operational detail.
    During an unplanned outage, the first message should be brief and useful: identify the affected service, confirm that the issue is being assessed, direct people to safe alternatives, and provide a time for the next update. Do not speculate about cause or blame. If people are trapped, communicate that responders have been contacted and maintain voice contact through approved means. Public messages should not disclose passenger identities, medical details, security weaknesses, or protected control information.
    Shift handovers must carry more than “elevator down.” The incoming team needs the car identifier, current physical and supervisory state, barriers in place, known passengers or accessibility impacts, work-order number, contractor status, authority contacts, next update time, and who may release the car. A written handover reduces duplicate calls and prevents an uninformed employee from removing a sign or changing a control.
    After restoration, inform affected groups, remove obsolete notices, and record the release source and time. For significant incidents, issue a measured follow-up describing verified facts, corrective action, and any operational changes. Communications should acknowledge disruption without overstating certainty. Trust grows when updates are timely and consistent, not when technical language is used to disguise gaps in knowledge.
  </section>

  <section aria-labelledby="entrapment">
    <h2 id="entrapment">Passenger entrapment response</h2>
    A stalled car with passengers inside is distressing but is not automatically a medical emergency. The safest response is a controlled rescue by trained responders using the site plan and equipment-specific methods. Untrained staff must not force doors, access the hoistway, move the car through restricted controls, or encourage passengers to climb out. The car may be between floors, and conditions outside the doors may be more dangerous than remaining inside.
    When a call arrives, establish communication if possible. Identify the building and car, number of passengers, reported injuries or medical conditions, smoke, water, unusual movement, odors, heat, and whether communication is stable. Tell passengers that help is being arranged, ask them to remain calm and away from doors, and provide realistic updates. Do not promise an exact release time. If there is fire, a serious medical issue, loss of communication with signs of danger, or another urgent hazard, contact emergency services according to policy.
    Dispatch the elevator contractor through the approved emergency channel and meet responders with access information. Secure affected landings and prevent others from calling or approaching the car. Preserve communications logs and note key times: first report, dispatch, arrival, release, medical assistance, and return-to-service decision. Only the competent responder should determine the release method. Building personnel support crowd control, passenger care, and coordination.
    After release, offer appropriate first aid or medical assessment, collect factual contact information consistent with privacy policy, and avoid argumentative questioning. The elevator should remain out of public service until evaluated and formally released. An incident review should examine technical findings, response time, communications, accessibility needs, contractor performance, and whether procedures worked. The purpose is learning and prevention, not pressuring staff or passengers into a preferred account.
  </section>

  <section aria-labelledby="other-incidents">
    <h2 id="other-incidents">Response to misleveling, door events, water, and damage</h2>
    Misleveling occurs when the car floor is not sufficiently aligned with the landing, creating a trip or fall hazard. If observed, stop passengers from entering or leaving where that can be done safely, protect the landing, and report the exact approximate difference and car location. Do not attempt to reposition the car through restricted operation. A small discrepancy may still be important, especially for wheelchair users, carts, or people with limited vision.
    Door contact or unexpected closing should be documented with the car, landing, direction, time, passenger account, and any visible damage. Do not test the event by repeatedly placing a body or object in the doorway. Door protective systems have defined performance and may use several technologies; casual demonstrations do not establish compliance. Remove the car from public use under approved building procedures and request qualified examination when injury, damage, or abnormal response is reported.
    Water near elevator equipment requires immediate coordination. Protect people from the wet area, notify facilities and the elevator contractor, and follow electrical and fire-system procedures. A car should not be sent into a suspected flooded zone for observation. If water originates above, consider all affected levels and shafts. After cleanup, dryness at the lobby does not prove that hidden equipment is safe. Qualified assessment and documented release are essential.
    Impact damage from carts, vehicles, construction, or vandalism can affect doors and entrances beyond visible dents. Secure the area, preserve video if available, identify witnesses, and obtain inspection. Do not allow a tenant’s urgency to turn a damaged entrance into an experiment. Where the event may involve a structural opening, electrical exposure, criminal act, or serious injury, notify the appropriate emergency and regulatory parties under the incident plan.
  </section>

  <section aria-labelledby="workflow">
    <h2 id="workflow">A controlled workflow for authorized service activity</h2>
    An authorized workflow begins with a defined need. The requester states the business or safety objective, affected car, desired window, load or activity, and relevant constraints. The property manager classifies the request: ordinary reservation, technical maintenance, inspection, fire-system test, emergency response, construction support, or another approved category. That classification determines who must approve and perform the work. If the purpose cannot be clearly stated, the mode should not be selected.
    Next comes planning. Verify that the requested function exists on that specific equipment and that current documentation supports the intended use. Identify authorized operators, affected interfaces, public controls, accessibility consequences, communication channels, and stop conditions. Schedule the elevator contractor, fire alarm provider, generator technician, security team, or inspector as necessary. Create a work order or permit that records scope and responsibility without distributing restricted operating details.
    At the start, hold a brief coordination meeting. Confirm identities, roles, equipment designation, expected status, alarms or notifications, barriers, emergency contacts, and who controls restoration. Inspect the public area for unrelated hazards and communicate the outage. The qualified person then establishes the technical state using approved procedures. Building staff observe only within their role and do not direct the technical method.
    During activity, maintain control of the work zone and record material changes. If conditions differ from the plan, pause and reassess. A different car, unexpected alarm, failed communication path, unplanned passenger demand, water leak, or missing participant can invalidate the original controls. Schedule pressure is not a reason to continue through uncertainty. Escalate to the person with authority to revise the plan.
    Restoration is a separate phase. The qualified person confirms technical readiness and communicates release. The property representative checks administrative items: barriers, notices, access control, fire alarm status, emergency power status, monitoring, and affected tenant routes. Conduct only the observations assigned to building staff. Record the release source, time, open deficiencies, and next action. If any required confirmation is absent, keep the unit unavailable.
  </section>

  <section aria-labelledby="table">
    <h2 id="table">Management questions by service category</h2>
    <table>
      <thead>
        <tr><th>Category</th><th>Primary purpose</th><th>Management focus</th><th>Typical release evidence</th></tr>
      </thead>
      <tbody>
        <tr><td>Normal passenger service</td><td>Routine automatic transportation</td><td>Availability, accessibility, observed condition, call response, communications</td><td>Normal indicators and approved operational checks with no active restriction</td></tr>
        <tr><td>Reserved or independent use</td><td>Controlled authorized trip or activity</td><td>Traffic impact, load suitability, supervision, tenant coordination, time limit</td><td>Authorized user confirms completion and designated staff confirm return to group service</td></tr>
        <tr><td>Technical inspection or maintenance</td><td>Qualified examination, testing, adjustment, or repair</td><td>Credential verification, safe work zone, contractor control, public protection</td><td>Formal communication from the qualified elevator professional</td></tr>
        <tr><td>Firefighters’ emergency operation</td><td>Life-safety recall and responder use</td><td>Emergency plan, responder authority, evacuation messaging, system interfaces</td><td>Release under the approved fire and elevator restoration process</td></tr>
        <tr><td>Emergency-power operation</td><td>Limited elevator availability during utility loss</td><td>Sequencing, priority, generator capacity, testing, accessibility, dependencies</td><td>Verified normal transfer or approved emergency state with documented system status</td></tr>
        <tr><td>Security restriction</td><td>Controlled floor or car access</td><td>Threat authority, life-safety precedence, privacy, crowd movement, audit trail</td><td>Authorized security release plus confirmation of normal elevator access behavior</td></tr>
      </tbody>
    </table>
  </section>

  <section aria-labelledby="training">
    <h2 id="training">Training that respects role boundaries</h2>
    Training should give each role enough knowledge to act safely without teaching restricted actions to people who do not need them. All front-line staff can learn how to identify cars, report observations, protect a landing, communicate with trapped passengers, contact responders, support people with disabilities, and preserve incident information. They can also learn explicit prohibitions: no forced entry, no hoistway access, no improvised rescue, no bypassing devices, and no unauthorized control changes.
    Managers need additional training in permits, contracts, inspection obligations, impairment procedures, tenant communication, and release authority. Security teams need alarm-routing and crowd-management practice. Building engineers need a precise written boundary between permitted building-system tasks and elevator work reserved for licensed personnel. Elevator contractors need site orientation covering fire command, emergency power, access control, hazardous materials, communication paths, and building rules.
    Scenario exercises are more useful than memorizing mode names. A tabletop can ask what happens when a car is unavailable before a large event, a generator test leaves one unit offline, a wheelchair user loses access to a tenant floor, or an entrapment call coincides with a fire alarm. Participants practice decisions, notifications, and handoffs without operating equipment. Exercise observers should record gaps and assign corrective actions.
    Competence should be verified periodically through questions, drills, observation, and record review. Training expires as staff change, systems are modernized, and regulations evolve. A sign-in sheet proves attendance, not understanding. Refresher content should incorporate actual incidents and near misses while protecting privacy. The desired outcome is calm recognition and escalation, not confidence unsupported by authority.
  </section>

  <section aria-labelledby="vendors">
    <h2 id="vendors">Contractor management and service-level expectations</h2>
    A strong elevator maintenance contract defines covered equipment, preventive tasks, callback terms, entrapment response, parts responsibilities, exclusions, testing support, reporting, after-hours communication, modernization interfaces, and record access. Lowest price alone can transfer hidden costs into downtime, repeat failures, and weak response. Procurement teams should evaluate competence, staffing depth, local parts capability, safety performance, regulatory history, and the quality of proposed maintenance.
    Service levels need careful definitions. “Response” might mean a telephone acknowledgment rather than a technician onsite. Entrapment response should be distinguished from routine outages. Targets should account for geography and emergency conditions without normalizing excessive delay. Escalation contacts must be tested, and the building should know when public emergency services are required rather than waiting solely for a contractor.
    Work orders should provide useful closure information and identify deferred risk. Repeated descriptions such as “reset and returned to service” deserve review if symptoms recur. Ask for root-cause analysis proportionate to the event and for recommendations supported by evidence. At the same time, avoid pushing technicians to release equipment before they are satisfied it is safe. Commercial pressure can undermine the independent judgment on which the owner relies.
    Performance meetings should examine planned maintenance completion, callbacks, repeat faults, entrapments, inspection findings, shutdown hours, parts lead times, communication quality, and open proposals. They should also track owner-caused delays, access problems, water conditions, power quality, and third-party interference. A fair shared record encourages improvement more effectively than blame based on incomplete data.
  </section>

  <section aria-labelledby="continuity">
    <h2 id="continuity">Business continuity and accessibility planning</h2>
    Elevator outages can interrupt tenancy, deliveries, food service, clinical activities, events, and access to essential facilities. Continuity planning starts by mapping which floors depend on which cars and which occupants or operations have limited alternatives. Identify loading routes, service elevators, stairs, remote service options, and activities that can move temporarily. Do not assume every person can use stairs or that a freight route is suitable for passengers.
    For a single-elevator building, risk is concentrated. Plans may require priority maintenance coverage, critical spare strategies, temporary relocation arrangements, and rapid accessibility support. Multi-car buildings still have vulnerabilities when a shared controller, power source, fire alarm interface, lobby, or machine space affects several units. Portfolio planning should distinguish individual-car redundancy from genuine route redundancy.
    During a prolonged outage, establish a regular update rhythm even when there is no new completion date. Explain verified progress such as diagnosis, parts sourcing, repair, testing, or inspection without sharing sensitive details. Provide one accountable contact for accessibility needs and tenant coordination. Review planned events and deliveries daily. Temporary measures must be evaluated for safety, dignity, privacy, and legal compliance.
    Capital planning should use lifecycle evidence rather than waiting for chronic failure. Obsolescence, unavailable parts, callback trends, energy performance, ride quality, code changes, and tenant demand can justify modernization. Modernization itself introduces outages and interface risk, so scope should include fire alarm, power, communications, security, finishes, and acceptance testing. Preserve the safe intent of existing service functions while documenting any changed behavior.
  </section>

  <section aria-labelledby="communications-device">
    <h2 id="communications-device">Emergency communications and monitoring</h2>
    Passengers need a dependable way to summon assistance. Elevator emergency communications may include two-way voice, location identification, visual indication for people with hearing or speech disabilities, video or text features where required, and offsite monitoring. The applicable standard depends on the installation and jurisdiction. Building management should know who answers, how the correct building and car are identified, how calls escalate, and how communication works during a power or network failure.
    Tests must follow the required program and should verify the complete path, not merely the illumination of a button. Monitoring centers need current site contacts, car designations, access instructions held securely, and escalation criteria. Changes to telephone, cellular, internet, or private network services must be reviewed for elevator impact before legacy lines are disconnected. A low-cost telecommunications change can unintentionally disable a life-safety communication route.
    When a communication failure is discovered, assess whether the car may remain in service under local rules and approved interim measures. Do not assume that passenger mobile phones are an adequate substitute; signal may be unavailable and passengers may not have a phone or be able to use one. Document the impairment, contact the contractor, implement required notifications, and prioritize repair. Restore and test the complete route before closing the issue.
  </section>

  <section aria-labelledby="incident-command">
    <h2 id="incident-command">Incident command and multi-party coordination</h2>
    Serious elevator events can bring together fire services, emergency medical teams, police, elevator mechanics, inspectors, utility representatives, insurers, property managers, and corporate leaders. The building’s incident structure should establish one coordination point and respect public responder command. Multiple managers independently calling technicians or issuing instructions creates confusion and may place responders at risk.
    Provide responders with concise site facts: affected car and bank, last known location, number and condition of passengers, active alarms, smoke or water conditions, power status, available communications, known contractor activity, and safe access routes. Do not present assumptions as facts. Building drawings, keys, and technical spaces should be available only through controlled custody. A knowledgeable facility representative should remain accessible without crowding the work area.
    Regulatory reporting and evidence preservation should begin early. Depending on severity and jurisdiction, an injury, fatality, equipment damage, or emergency rescue may require prompt notification and restrictions on alteration before investigation. Preserve logs, work orders, video, photographs, witness information, and equipment status according to legal direction. Do not reset systems, clear electronic records, or authorize repair that could destroy evidence unless necessary for immediate safety and directed by the competent authority.
    Media and tenant inquiries should go through designated communications staff. Confirm concern for affected people, state verified operational facts, and avoid technical speculation. Internally, protect the independence of the investigation. The objective is to understand conditions and prevent recurrence, not to manufacture a simple narrative before evidence is available.
  </section>

  <section aria-labelledby="review">
    <h2 id="review">Post-incident review and organizational learning</h2>
    A proportionate review follows entrapments, injuries, emergency operations, significant outages, unintended mode changes, failed tests, and near misses. Assemble records and a timeline while memories are fresh. Include perspectives from occupants, front-line staff, responders, contractors, and managers. Separate observed facts from interpretations. Technical findings may arrive later, so early reports should remain open to revision.
    The review should ask whether prevention, detection, response, communication, and restoration controls worked. Was the condition reported promptly? Were car identifiers clear? Did monitoring reach the right person? Were passengers reassured? Did barriers protect the public? Did accessibility alternatives work? Was authority for release understood? Did the maintenance history reveal earlier warning signs? These questions produce actionable learning without requiring unqualified people to judge technical workmanship.
    Corrective actions need an owner, due date, priority, resources, and evidence of completion. Actions might update a contact list, clarify a contract, improve signage, repair communications, revise an outage template, change key custody, schedule technical work, or request a code review. “Retrain staff” should not be the default answer when the procedure, staffing, design, or tools made error likely.
    Share relevant lessons across the portfolio while removing personal and sensitive details. Similar equipment or processes may carry the same vulnerability. Confirm effectiveness later through drills, audits, data, or observation. A completed action is valuable only if it changes the conditions that contributed to the event.
  </section>

  <section aria-labelledby="audit">
    <h2 id="audit">A practical management audit</h2>
    A periodic audit can test whether elevator service governance exists beyond paper. Begin with the equipment inventory: every car should have a consistent identifier linked to location, type, capacity, certificate, maintenance provider, monitoring account, emergency-power status, and relevant drawings. Walk the site to confirm that records match reality and that labels are clear to responders and occupants.
    Review authority controls. Who holds restricted keys? Who can request independent use? Who can place administrative barriers? Who contacts the elevator contractor after hours? Who confirms release after fire alarm testing? Sample recent events to see whether actual decisions followed the matrix. Remove access no longer justified by role and correct undocumented customs.
    Inspect records for current permits, open deficiencies, planned maintenance, tests, callbacks, entrapments, communication checks, generator coordination, and modernization changes. Reconcile contractor records with building logs. Investigate unexplained gaps and repeated temporary fixes. Confirm that required documents are available where inspectors expect them while sensitive information remains protected.
    Test communication through scenarios rather than operating restricted equipment. Ask a receptionist how to handle a trapped-passenger call, a security officer how to protect an unsafe landing, and a manager how to support an occupant during a prolonged outage. Verify contacts and escalation paths. Record findings by risk, assign owners, and report closure to responsible leadership.
  </section>

  <section aria-labelledby="principles">
    <h2 id="principles">Decision principles for difficult moments</h2>
    When pressure is high, a few principles keep decisions grounded. Protect people before restoring convenience. Treat unexplained operation as a condition requiring assessment, not an invitation to experiment. Match authority and competence to the task. Use equipment-specific documents rather than memory or generic instructions. Preserve evidence before resets or changes. Communicate what is known, what is being done, and when the next update will come.
    Another useful principle is reversible administration before irreversible intervention. Staff can redirect occupants, pause deliveries, secure a lobby, call qualified help, and preserve logs without changing protected equipment. Those actions control exposure while retaining options. By contrast, forcing a door, bypassing a control, repeatedly cycling power, or entering a restricted space can create hazards and destroy diagnostic information.
    Finally, restoration deserves the same rigor as shutdown. A moving car is not necessarily a serviceable car. Release must account for doors, leveling, communications, dispatch, alarms, emergency functions, accessibility, and any conditions imposed by an inspector or technician. Record who made the determination. If responsibility is unclear, the unit remains unavailable until it is clear.
  </section>

  <section aria-labelledby="conclusion">
    <h2 id="conclusion">Conclusion: govern the exception</h2>
    Elevator service modes exist because normal automatic operation cannot satisfy every maintenance, emergency, security, and operational need. Their value depends on disciplined use. In a well-managed commercial building, each mode has a defined purpose, authorized user, documented impact, communication plan, and restoration path. Restricted functions remain restricted, even when a queue forms or a schedule slips.
    The owner provides compliant equipment and competent maintenance. Property managers coordinate people and information. Building engineers observe and support within their scope. Security protects the public and routes reports. Licensed elevator personnel control technical work. Inspectors and emergency responders exercise their independent authority. Occupants receive clear instructions and accessible alternatives. These roles overlap in communication, but they should not blur in authority.
    The safest organizations are not those whose staff know the most switch positions. They are those whose staff recognize abnormal conditions, preserve boundaries, communicate calmly, and bring the right expertise to the scene. By combining safety planning, compliance management, inspection discipline, controlled access, tested incident response, and evidence-based learning, a building can keep vertical transportation dependable without turning exceptional operating modes into routine shortcuts.
  </section>
</article>