Emergency devices: firefighter switches, communications and lighting

In ELV-310, Tamsin learned how a controller runs firefighters' emergency operation: Phase I recall, Phase II in-car operation and emergency power sequencing. This lesson is about the hardware that firefighters and passengers actually touch: the key switches in the lobby and the car, the keys themselves, the signals in the car, the emergency communication equipment and the car's emergency lighting. Priya spent a week on it with Tamsin at Holloway, the hospital, where every one of these devices matters most and the fire department tests them with Northcrest twice a year. "Firefighters use our equipment in the worst conditions there are, with smoke, no power and no time," she said. "Every switch has to be where they expect it, work the way they expect, and take the key they carry."

The Phase I switch and the firefighters' key

Each group of elevators has a Phase I switch at the designated level, usually the main fire department entrance floor, mounted in or beside the hall fixture where firefighters will look for it. On equipment built to recent codes, it has three positions, RESET, OFF and ON, and is turned by the standard firefighters' key; in the ON position it recalls the cars to the recall level, and RESET clears an automatic recall once the fire alarm has been reset. Older cars may have different positions, such as OFF, ON and BYPASS, and the controller logic from ELV-310 depends on which version is fitted. A sign next to the switch tells firefighters what each position does.

Every Phase I and Phase II switch, and the switches for related fire service functions, must be operated by the same standard key, so that a firefighter's single key works in any building. Since the 2007 edition, the code has required a specific standard key and cylinder, known by its designation FEO-K1, for these switches. In British Columbia, Technical Safety BC issued a safety order in 2014 requiring applicable firefighters' key switches to be brought into line with that requirement; the order was rescinded on 27 October 2026, the compliance work having been done, so a non-compliant switch is now simply a code defect. The key must be kept where the fire department can get it, often in a key box at the designated level or in the fire alarm annunciator, and copies must not be issued to building staff or tenants. The key also opens the in-car firefighters' panel.

The in-car firefighters' panel

Inside each car, behind a locked cover opened with the same key, is the firefighters' panel. It has a Phase II switch with OFF, HOLD and ON positions, door open and door close buttons for constant-pressure door operation, a call cancel button, often a stop switch, and the visual fire hat signal. Operating instructions are engraved or permanently fixed on the panel. With the car recalled and the Phase II switch turned ON, the firefighter has full control: car calls register only from inside, doors open and close only on constant pressure, and the reopening devices that smoke could fool are inoperative, as lesson 5 explained. HOLD keeps the car at a floor with its doors open, and OFF returns the car toward the recall level when the doors are closed. The exact behaviour, including what happens when the Phase II switch is turned OFF with the doors open, follows the code edition the car was built to, and ELV-310 lesson 10 sets it out.

The visual signal is a fire hat symbol in the car's operating panel. It lights steadily during Phase I recall and Phase II operation. It flashes when the recall was caused by a fire alarm initiating device in the machine room, machinery space or hoistway, warning the firefighter that the elevator equipment itself may be affected by fire and that the car should not be relied on. Hall signals at the designated level and some landings show the same symbol. A buzzer or tone in the car sounds when Phase I recall starts, so that passengers know why the car is not answering their calls.

# Fire hat visual signal in the car: what it should show
def hat_signal(phase1_active, phase2_on, initiated_by):
    if not (phase1_active or phase2_on):
        return "off"
    if initiated_by in ("machine room detector", "hoistway detector"):
        return "flashing: elevator equipment area affected by fire"
    return "steady"
cases = [(False, False, None), (True, False, "lobby detector"), (True, False, "machine room detector"),
         (False, True, "Phase I key switch"), (True, True, "hoistway detector")]
for p1, p2, src in cases:
    print(f"Phase I {'on ' if p1 else 'off'}, Phase II {'on ' if p2 else 'off'}, cause {str(src):<22} -> {hat_signal(p1, p2, src)}")

Phase I off, Phase II off, cause None                   -> off
Phase I on , Phase II off, cause lobby detector         -> steady
Phase I on , Phase II off, cause machine room detector  -> flashing: elevator equipment area affected by fire
Phase I off, Phase II on , cause Phase I key switch     -> steady
Phase I on , Phase II on , cause hoistway detector      -> flashing: elevator equipment area affected by fire

This is the rule as it appears in recent editions; older equipment may light the signal differently, and Holloway's two hydraulic cars, modernized in different years, behave slightly differently from each other. The fire department's tests check each car against its own edition.

Fire alarm inputs

Automatic Phase I recall is started by the building's fire alarm system through smoke detectors or other initiating devices in the elevator lobbies, the machine room or machinery space, and the hoistway where detectors are required there. The fire alarm system tells the elevator controller which group of devices has operated, normally through separate relay contacts: one for the designated level's lobby, which recalls the cars to the alternate level instead, one for the other lobbies, which recalls to the designated level, and one for the machine room or hoistway, which also makes the hat signal flash. This wiring is the boundary between two trades: the fire alarm technician owns the fire alarm system and its relay outputs, and the elevator mechanic owns the elevator inputs. Joint tests, with both trades present, prove that each detector group produces the right recall.

Lesson 4 of ELV-310 described the Quayside incident in which a fire alarm technician changed the alternate recall level in the elevator controller with a borrowed password. The lesson from it is that each trade works only on its own side of the boundary, and every change is tested with both present.

Emergency communications

Every passenger car must have a means for a trapped passenger to call for help, connected to a location that is staffed at all times, such as a monitoring centre, and the communication must be two-way. Passengers start a call with a button marked with the code's symbol; the call must connect without dialling, and the device must tell the people answering which car the call comes from. If a call is not acknowledged within a short time, the code requires it to be redirected automatically to an alternate location; the 2019 and later editions set that time at 45 seconds. The communications equipment must have a standby power source so that it works in a power failure, and recent editions require it to work for at least four hours, with the in-car audible alarm signal working for at least one hour.

The 2019 and later editions added requirements for passengers who cannot speak or hear. On new and altered cars built to those editions, the in-car device must show a message confirming that help has been contacted, allow two-way text messaging with the people answering, show a message that help is on the way, and let the people answering see video of the car interior so that they can judge the situation. Buildings with a rise of 18 m (60 ft) or more must also have a means for emergency personnel inside the building to talk to passengers in each car. Older cars have only the voice requirements of their own edition, and upgrades follow the alteration rules.

# Monthly emergency phone test log: does each car's call reach the monitoring centre?
max_ack = 45     # seconds before an unanswered call must go to the alternate location
log = {"Holloway car 1": (12, True, True), "Holloway car 2": (51, True, False),
       "Quayside car 3": (9, True, True), "Larchmont": (14, False, True)}
for car, (ack_s, car_identified, rerouted_ok) in log.items():
    notes = []
    if ack_s > max_ack and not rerouted_ok:
        notes.append(f"not answered in {ack_s} s and not rerouted")
    if not car_identified:
        notes.append("centre could not tell which car")
    print(f"{car:<15} answered in {ack_s:3d} s -> {'pass' if not notes else 'FAIL: ' + '; '.join(notes)}")

Holloway car 1  answered in  12 s -> pass
Holloway car 2  answered in  51 s -> FAIL: not answered in 51 s and not rerouted
Quayside car 3  answered in   9 s -> pass
Larchmont       answered in  14 s -> FAIL: centre could not tell which car

Northcrest tests every car's emergency communication monthly under the maintenance control program and records the result. Holloway car 2's line had been moved to a new telephone system during a hospital renovation, and the automatic rerouting had not been set up on the new system; the hospital's telecommunications group corrected it the same week. Larchmont's device worked but did not identify the car, so the centre's operator had to ask the passenger where they were, which is no help to a passenger who cannot speak.

Car emergency lighting and the alarm

If normal power to the car fails, emergency lighting in the car must come on automatically, powered by a battery or other standby source on the car or in the controller, and must last for the time the code sets, which in recent editions is at least four hours. The light must be bright enough at the car operating panel for passengers to see the alarm button and the communication device. The in-car alarm, the audible signalling device operated by the alarm button, must also work on standby power. Both are tested by switching off the car's lighting supply and timing a full discharge test at the intervals the maintenance control program sets, because a battery can pass a short test and still fail long before four hours.

# Car emergency light and alarm battery: will it last?
battery_ah = 7.0          # rated capacity, A h
volts = 12
usable = 0.8               # fraction usable at end of life and in a cold car
loads_w = {"emergency light": 6.0, "communication device standby": 4.0, "alarm signal (average)": 1.5}
load = sum(loads_w.values())
hours = battery_ah * volts * usable / load
print(f"total load {load:.1f} W -> about {hours:.1f} h")
print("meets 4 h" if hours >= 4 else "SHORT OF 4 h: larger battery or lower load needed")

total load 11.5 W -> about 5.8 h
meets 4 h

Larchmont's emergency light was upgraded to a brighter fixture during a cab renovation, without the battery being changed. The calculation shows how close the margin is; a discharge test confirmed the battery would not last four hours, and a larger battery was fitted.

Other emergency devices

Several smaller devices complete the set. Stop switches in the car, where fitted on passenger cars built to recent editions, are key-operated or behind the firefighters' panel cover, because passengers using them caused entrapments; stop switches on the car top, in the pit and in machinery spaces are for mechanics and must be easy to reach. Emergency power selection switches at the designated level choose which car runs on standby power, as ELV-310 described. Seismic switches and counterweight displacement detectors, required in some regions, put cars into seismic operation. Hospital service switches, like Holloway's, let staff take a car for a medical emergency. Each has its place in the maintenance control program and its own test.