Special operations: fire service, emergency power and independent service

Most of the time, a passenger elevator runs in normal automatic operation, and most of what a controller does is designed around that. But the controller also has a set of special operations that change how the car behaves, and some of them matter more than anything else it does. In a fire, the cars must return to a safe floor, open their doors and stay there for firefighters. In a power failure in a hospital, the cars must bring their passengers to a floor and then let one car at a time run on the emergency generator. A building may need a car taken out of the group for a move-in or a patient transfer. Each of these is a special operation, and each must be tested regularly. Priya scheduled Tamsin's fire service and emergency power tests with the fire alarm contractor and Holloway's facilities team, because these are tests nobody can do alone.

Firefighters' emergency operation

Firefighters' emergency operation, often called fire service, has two parts. Phase I is recall: when it is activated, every car stops answering calls, cancels its car calls, closes its doors and returns without stopping to a recall level, opens its doors there and stays with its doors open and out of normal service. Phase II is in-car operation by firefighters: once the cars are recalled, a firefighter with the fire service key can take a car and run it from inside, under rules designed for a burning building. The code requirements are detailed and have changed many times over the decades, so a car's fire service operation depends on the code edition it was built or altered to.

Phase I can be activated in two ways. A key switch at the designated level, usually the main lobby, lets firefighters or building staff recall the cars by hand. And smoke detectors, or other fire alarm initiating devices, in the elevator lobbies, the machine room or control space and the hoistway, wired through the building's fire alarm system, activate recall automatically. The recall level depends on where the fire is detected. Normally the cars go to the designated level. If the detector that activated recall is in the lobby at the designated level, the cars go instead to an alternate level, so they do not open their doors into the fire. And if the detector is in the machine room or hoistway, a visual signal in the car, a firefighter's helmet symbol, flashes to warn firefighters that the elevator equipment itself may be affected.

# Where do the cars go when Phase I recall is activated?
designated, alternate = 1, 2

def recall(source):
    if source == "lobby key switch":
        return designated, False
    if source == "smoke detector, designated level lobby":
        return alternate, False
    if source in ("smoke detector, machine room", "smoke detector, hoistway"):
        return designated, True      # helmet signal flashes
    return designated, False         # detector at any other floor's elevator lobby

for src in ["lobby key switch", "smoke detector, floor 14 lobby",
            "smoke detector, designated level lobby", "smoke detector, machine room",
            "smoke detector, hoistway"]:
    floor, flash = recall(src)
    print(f"{src:<40} -> recall to floor {floor}{', helmet signal flashing' if flash else ''}")

lobby key switch                         -> recall to floor 1
smoke detector, floor 14 lobby           -> recall to floor 1
smoke detector, designated level lobby   -> recall to floor 2
smoke detector, machine room             -> recall to floor 1, helmet signal flashing
smoke detector, hoistway                 -> recall to floor 1, helmet signal flashing

The rule set in the code is more detailed than this: for example, a machine room or hoistway detector may send the cars to the alternate level if the machine room is at the designated level, and the order in which detectors activate matters. The car's controller and the fire alarm system must agree, which is why Phase I is tested with the fire alarm contractor, who activates each detector or its input while the elevator mechanic watches what the cars do.

Phase II

Phase II lets a firefighter operate a car from inside, after it has been recalled. The firefighter turns the car's Phase II key switch to on. The car then responds only to car calls entered from inside, ignores hall calls, and does not open its doors automatically: the doors open only while the firefighter holds the door open button, and if it is released before the doors are fully open, they close again, so the firefighter can back out of a floor that is on fire. The doors close the same way, with constant pressure on the close button. A call cancel button clears all car calls. Turning the switch to hold at a floor keeps the car there with its doors open, so the firefighter can remove the key and leave the car without anyone else using it. Turning it off at the recall level returns the car to Phase I.

Phase II is where many older cars fall short of current code, and it is where tests most often find faults: a door open button that opens the doors fully on a tap instead of needing constant pressure, a car that answers a hall call, or a key switch worn so the key turns past its positions. On the Phase I lobby switch, newer codes have separate positions or switches for reset and bypass of the fire alarm signal, which lets staff restore normal service after a false alarm only when it is safe; older cars have a simpler on and off switch. Tamsin's test sheet at Quayside followed the maker's sequence and the code's list, item by item, with the fire alarm technician activating each input.

Recent editions of the codes also include occupant evacuation operation, which lets elevators help evacuate the occupants of a tall building during a fire when the building code calls for it, under the direction of the fire alarm system. Quayside was not designed for it, but some new towers in both cities have it, and it changes the rules for which cars run and where.

Emergency power operation

Many buildings, and all hospitals, have an emergency or standby generator that can run some or all of the elevators when the utility supply fails. When the generator cannot run every car at once, which is usual because a generator large enough to start every elevator motor together is expensive, the controllers must share the power. The code's approach is that when the normal supply fails and emergency power is available, the cars are brought automatically, one or more at a time, to a designated floor, where they open their doors and park; then one car, or as many as the generator can carry, is selected to run in service. A selector switch at the designated level lets building staff or firefighters choose which car runs.

Holloway Memorial Hospital's two hydraulic cars are on the hospital's emergency generator, and the hospital's own rules require at least one car to be available to move patients within a short time of a power failure. Holloway's controllers sequence the cars: car 1 lowers to the lobby first and opens its doors, then car 2. With both cars parked, car 1 is automatically selected to run on emergency power, unless staff turn the selector to car 2. Traction cars add a complication. A regenerative drive returns energy to the supply when an empty car rises or a full car descends, and a generator cannot absorb returned energy the way the utility can; a traction car on emergency power must dissipate it in a braking resistor, or the generator's voltage and frequency can rise and trip it. Quayside's drives switch to their braking resistors automatically when the controller sees the emergency power signal.

# Emergency power sequencing: lower or return cars one at a time, then select one to run
cars = [("car 1", "floor 3", 25), ("car 2", "floor 1", 0), ("car 3", "floor 12", 70), ("car 4", "floor 7", 45)]
gen_capacity = 1           # cars the generator can run at once
t = 0
print("normal power lost; emergency power available after 10 s")
t = 10
for name, where, seconds_to_return in cars:
    if seconds_to_return == 0:
        print(f"{t:4d} s  {name} already at the designated floor, doors open, parked")
        continue
    print(f"{t:4d} s  {name} at {where}: returns to the designated floor")
    t += seconds_to_return
    print(f"{t:4d} s  {name} parked with doors open")
selected = "car 1"
print(f"{t:4d} s  all cars parked; {selected} selected to run on emergency power ({gen_capacity} at a time)")
print("        the selector switch at the designated floor lets staff choose another car")

normal power lost; emergency power available after 10 s
  10 s  car 1 at floor 3: returns to the designated floor
  35 s  car 1 parked with doors open
  35 s  car 2 already at the designated floor, doors open, parked
  35 s  car 3 at floor 12: returns to the designated floor
 105 s  car 3 parked with doors open
 105 s  car 4 at floor 7: returns to the designated floor
 150 s  car 4 parked with doors open
 150 s  all cars parked; car 1 selected to run on emergency power (1 at a time)
        the selector switch at the designated floor lets staff choose another car

Running the cars one at a time means the last car may take minutes to come down. A building with a larger generator may return two or more at a time. The sequence and the time are part of the acceptance test and the periodic tests of emergency power, which are done with the building's electrical staff because they involve switching the building to the generator.

Independent service and other operations

Several other special operations change how a car runs.

• Independent service takes a car out of the group and lets one person, usually a building staff member with a key, run it from inside on car calls only, with the doors staying open at each floor until a call is entered. It is used for moving furniture, carrying patients, or a VIP. A car left on independent service is a common reason for a group seeming to have too few cars.
• Attendant operation, on some hospital and hotel cars, lets an attendant run the car from inside while hall calls are shown to them.
• Hospital emergency service, or code blue operation, on hospital cars, lets staff call a car directly to a floor for an emergency patient transfer, with the car cancelling its other calls and going express.
• Inspection operation, covered in Lesson 2, and hoistway access operation, which lets a mechanic move the car a short distance from a landing with the hoistway door open to reach the car top or pit.
• Seismic operation, required in earthquake regions including both cities in this course, uses a seismic switch and on traction cars a counterweight displacement detector. After an earthquake, the cars stop at the nearest floor, open their doors and remain out of service or run at reduced speed until a mechanic inspects them, because a counterweight that has left its rails in a strong earthquake could strike the car.
• Out-of-service and parking operations let building staff send a car to a floor and shut it down, for cleaning or security.

Each operation is a mode in the controller's state machine with its own rules for calls, doors and the group, and each must work alongside the others. Fire service overrides independent service: a car on independent service when Phase I is activated must sound a signal and, after a short delay, return. Emergency power and fire service can be active together, and the codes set how they interact. Testing them together is part of acceptance and of the regular tests.

Testing special operations

Special operations are tested at acceptance, after any alteration that affects them, and periodically under the maintenance part of the code; fire service is commonly tested monthly by the building or the maintenance contractor, with a full test of Phase I and II at longer intervals. Technical Safety BC expects the results to be recorded, and a car whose fire service does not work is usually removed from service until it is fixed. Northcrest's test sheets list each function, how it was activated, what the cars did and who witnessed it.

# Monthly fire service test record: every item must pass
items = {
    "Phase I key switch recalls all cars to designated level": True,
    "Lobby detector sends cars to alternate level": True,
    "Machine room detector flashes helmet signal": True,
    "Phase II: doors open only with constant pressure": True,
    "Phase II: hall calls ignored": True,
    "Phase II: call cancel clears car calls": False,
    "Phase II: hold keeps car at floor with doors open": True,
}
failed = [k for k, ok in items.items() if not ok]
for k, ok in items.items():
    print(f"{'pass' if ok else 'FAIL'}  {k}")
print(f"{len(items) - len(failed)} of {len(items)} items passed")
if failed:
    print("car removed from service until repaired and retested; regulator notified as required")

pass  Phase I key switch recalls all cars to designated level
pass  Lobby detector sends cars to alternate level
pass  Machine room detector flashes helmet signal
pass  Phase II: doors open only with constant pressure
pass  Phase II: hall calls ignored
FAIL  Phase II: call cancel clears car calls
pass  Phase II: hold keeps car at floor with doors open
6 of 7 items passed
car removed from service until repaired and retested; regulator notified as required