Electrical safety and lockout for elevator work

Tamsin Iwasaki is in her second year with Northcrest Elevator. The first year taught her how a hoistway can kill you through falls, moving equipment and stored mechanical energy. The second year adds the electrical side of the trade. Over the next few months she will spend her days on the Route 7 service route with Ray Abernethy and her evenings in the branch's electrical theory block, taught by Priya Sandhu, Northcrest's senior adjuster. Priya sets up and tunes controllers and drives on new installations and modernizations. Her first evening session does not start with Ohm's law. It starts with the ways electricity hurts people, because every measurement Tamsin will make in this course is made on equipment that can hurt her if she treats it carelessly.

Elevator work has more electrical exposure than most people expect. A mechanic opens a controller cabinet several times a day, often with the mainline power on, to read a fault code, measure a voltage or watch a relay drop out. The equipment runs at 480 V three-phase on the power side, at 120 V and lower on the control side, and at several hundred volts DC inside a drive. Some of it stays live after the main disconnect is opened. This lesson covers the hazards, the boundaries and protective equipment that keep a mechanic out of them, and the lockout and verification steps that make equipment safe to touch.

Three ways electricity injures

The first hazard is shock: current passing through the body. The damage depends on how much current flows, the path it takes and how long it lasts. A current through the chest, from hand to hand or hand to foot, is the most dangerous path because it crosses the heart. The second hazard is the arc flash: a short circuit through air, often caused by a dropped tool, a slipped meter probe or a failed component. An arc reaches temperatures several times hotter than the surface of the sun for a fraction of a second, and it burns skin and ignites clothing at a distance. The third hazard is the arc blast: the pressure wave from the arc, which throws people, ruptures eardrums and turns parts of the equipment into shrapnel. A mechanic can also be hurt indirectly, by falling from a car top or a ladder after a minor shock, or by jerking a hand back into a moving part.

The current depends on the voltage and the resistance of the body and its contacts. Dry, calloused skin can have a resistance of many thousands of ohms, but wet or sweaty skin, a cut, or a firm grip on a metal part drops it sharply. Once the skin is broken down, the inside of the body has a resistance of the order of 500 to 1,000 ohms. The code below estimates the current for a hand-to-hand path at the voltages Tamsin meets in a controller. The resistances are illustrative, chosen to show the range rather than to predict any particular shock.

# Estimated body current, hand to hand, at elevator voltages (illustrative resistances)
voltages = {"120 V control": 120, "277 V lighting": 277, "480 V mainline": 480}
paths = {"dry skin, light touch": 20000, "sweaty hands, firm grip": 2000, "wet, broken skin": 1000}
for vname, v in voltages.items():
    for pname, r in paths.items():
        ma = 1000 * v / r
        effect = ("painful" if ma < 10 else "may not let go" if ma < 50 else "fibrillation possible")
        print(f"{vname:<18} {pname:<24} {ma:7.1f} mA  {effect}")

120 V control      dry skin, light touch        6.0 mA  painful
120 V control      sweaty hands, firm grip     60.0 mA  fibrillation possible
120 V control      wet, broken skin           120.0 mA  fibrillation possible
277 V lighting     dry skin, light touch       13.8 mA  may not let go
277 V lighting     sweaty hands, firm grip    138.5 mA  fibrillation possible
277 V lighting     wet, broken skin           277.0 mA  fibrillation possible
480 V mainline     dry skin, light touch       24.0 mA  may not let go
480 V mainline     sweaty hands, firm grip    240.0 mA  fibrillation possible
480 V mainline     wet, broken skin           480.0 mA  fibrillation possible

Even 120 V, the voltage of the control circuits Tamsin will test most often, can drive a dangerous current through wet skin. That is the point of the exercise: there is no voltage in a controller that is low enough to treat casually.

Sources of energy in an elevator

An elevator is fed from a mainline disconnect in the machine room, the control room or, on a machine-room-less unit such as the Quayside Tower cars, a control space near the top landing. Opening the mainline disconnect removes power from the drive, the hoist motor and the controller, but it does not make the whole installation dead. The electrical code requires the car lighting, the car receptacles and the car ventilation to be supplied from a separate disconnect, so that passengers are not left in the dark when the mainline is opened. The machine room lighting and receptacles are on another circuit again. Many controllers have an emergency power input, a battery rescue unit or an uninterruptible supply that can move the car to a landing during a power failure. Group controllers in a bank of cars may share signals between cabinets, so a wire in one controller may be live from another.

Inside a drive, the capacitors on the DC bus store energy after the power is off. A modern drive charges its bus to about 1.35 to 1.4 times the incoming line voltage, which is about 650 V DC on a 480 V supply. The drive has bleed resistors that discharge the bus, and the manufacturer states a waiting time, often five to fifteen minutes, before the cabinet may be worked in. The stored energy follows from the capacitance and the voltage.

The bus voltage falls exponentially as the bleed resistors drain the capacitors. The code below shows the decay for an illustrative bus, and the time it takes to fall below 50 V, a common threshold for treating a part as no longer hazardous. Priya's point is that the waiting time on the drive label is a minimum, not a guarantee, because a failed bleed resistor leaves the bus charged indefinitely. The bus is always measured before anyone touches it.

# DC bus decay after the drive is switched off (illustrative values)
import math
v0 = 650               # DC bus voltage at switch-off, V
C = 4.7e-3              # bus capacitance, F
R = 47e3                # bleed resistance, ohms
tau = R * C             # time constant, s
print(f"stored energy at switch-off: {0.5 * C * v0 ** 2:,.0f} J")
for t in (0, 60, 120, 300, 600):
    print(f"after {t:4d} s: {v0 * math.exp(-t / tau):6.0f} V")
t50 = tau * math.log(v0 / 50)
print(f"time to fall below 50 V: {t50 / 60:.1f} min (if the bleed resistors work)")

stored energy at switch-off: 993 J
after    0 s:    650 V
after   60 s:    495 V
after  120 s:    378 V
after  300 s:    167 V
after  600 s:     43 V
time to fall below 50 V: 9.4 min (if the bleed resistors work)

Mechanical energy is part of electrical lockout too. A traction car held by its brake is storing the energy of any imbalance between the car and the counterweight. If someone lifts the brake by hand, or if a fault energizes the brake coil, the car moves. A hydraulic car stores energy in its pressurized oil. Ray's lockout always considers both the electrical sources and what the car will do if the brake or valve opens.

Approach boundaries and arc flash

Workplace electrical safety in the United States follows NFPA 70E, the Standard for Electrical Safety in the Workplace. It sets approach boundaries around exposed energized parts and requires an assessment of shock and arc flash risk before work begins. OSHA's electrical safety-related work practice rules require de-energizing before work unless that is infeasible or creates greater hazards, and its lockout standard, enforced in Washington by DOSH under its own lockout chapter, sets out how equipment is isolated. The current edition of NFPA 70E was published in 2024, and its Canadian counterpart, CSA Z462, was revised the same year.

The limited approach boundary is the distance from an exposed energized part inside which a shock hazard exists. Only qualified persons, or unqualified persons escorted by them, may cross it. The restricted approach boundary is closer, at a distance where an inadvertent movement could bring a person into contact. Crossing it requires shock protection: rated gloves, insulated tools and a plan. The arc flash boundary is the distance at which an arc would deliver an incident energy of 1.2 cal/cm², the level at which bare skin would receive a second-degree burn. Inside it, arc-rated clothing and face protection matched to the hazard are required.

For the voltages in an elevator controller, between 151 and 750 V, the standards give a limited approach boundary of 3 ft 6 in for fixed parts and a restricted approach boundary of 1 ft. The arc flash boundary has no fixed value. It depends on how much fault current the building supply can deliver and how fast the upstream protection clears it, and it is printed on the arc flash label on newer equipment. Older buildings on Route 7, such as the Tillicum Building, have no labels, so Northcrest uses the PPE category method from the standard's tables, with arc-rated clothing and a face shield as a minimum for work in an open 480 V controller.

Northcrest's branch policy, written by Lena Ostrander, is that every field employee wears arc-rated daily workwear, that the hood and the rated gloves come out for any measurement on the mainline side, and that meters, test leads and gloves are inspected before each use. Rubber insulating gloves are air-tested for pinholes by rolling the cuff, worn with leather protectors and returned for electrical retesting on a fixed schedule.

Lockout for elevator work

Lockout means isolating every source of energy and keeping it isolated with a personal lock while work is done. For an elevator, Ray's procedure follows the branch's written steps:

• Tell the building and the people affected. Park the car at a landing, out of service, with a barricade if a hoistway door will be opened.
• Identify every source: mainline, car lighting, emergency power, any battery unit, and any power from a group controller or a fire alarm interface.
• Open the disconnects and apply a personal lock and tag to each. Every worker who will be exposed applies their own lock, using a group lock box if there are many.
• Dissipate stored energy: wait for the drive bus to discharge, block or secure the car if the work will affect the brake or the ropes, and relieve hydraulic pressure on a hydraulic unit.
• Verify. Test the meter on a known live source, test the isolated circuit phase to phase and phase to ground, and test the meter again on the known source. This live-dead-live test proves that the meter worked when it read zero.
• Try the controls. With the disconnect locked, operate the run buttons on the inspection station to show that the car does not move.

Only after verification is the equipment treated as dead. A reading of zero from an untested meter proves nothing, and Ray's rule from Tamsin's first week, test before you trust, applies to meters as much as to equipment.

The car lighting circuit is a common trap. It is fed by a separate disconnect, often in the same machine room, and its conductors run through the traveling cable to the car. A mechanic who locks out only the mainline and then works in the car top junction box may be working on a live 120 V circuit. In the United States the requirements for the separate disconnect are in Article 620 of the National Electrical Code; Washington enforces the 2023 edition and has adopted the 2026 edition to take effect at the end of 2026.

When work must be done energized

Much of an elevator mechanic's electrical work is diagnosis, and diagnosis needs power: a voltage can only be measured on a live circuit, and a relay can only be watched while it operates. The standards treat testing and troubleshooting as a recognized reason for working near energized parts, provided the risk is assessed, the right PPE is worn, the tools and meter are rated for the circuit, and only the diagnostic work is done live. Repairs are made after the equipment is locked out. Northcrest's rule is that an apprentice may take measurements in a live controller only with a qualified mechanic beside them, and that nobody works alone in a live controller.

Jumpers are the other half of the story. A jumper is a wire used to bypass a contact for testing, for example to find out which door lock in a string is open. Jumpers on safety circuits have killed mechanics and passengers, because a car run with a bypassed door lock or limit switch can move with a hoistway door open or run past a terminal landing. Northcrest permits jumpers only by qualified mechanics, recorded in a jumper log, removed and checked before the car is returned to service. In her second year, Tamsin still places no jumpers. She will learn to find faults with a meter, which never bypasses anything.