Lift and escalator safety: a guide for building managers
Four things every building manager should understand about lift and escalator safety: what to do when someone is stuck in a lift, how escalator emergency stops work, when a lift pit or machine room is a confined space, and why the safety brake changed everything. Each section stands on its own.
Stuck in a lift
Almost every serious injury in a stalled lift happens during an attempted rescue, not during the wait. Here is what to do, what not to do, and what a building should have arranged before it happens.
The car is the safe place to be
A stalled lift car is not falling and it is not going to. The car is held by multiple ropes or by a hydraulic ram, and independent safety gear grips the guide rails if the car ever moves faster than it should. When a lift stops unexpectedly it has almost always done so deliberately: a safety circuit has detected something outside its normal operating conditions and taken the car out of service until someone competent looks at it.
Air is not a problem either. Lift cars are not sealed. The gap around the doors and the ventilation openings move far more air than anyone inside will use.
Use the emergency communication and wait
Press the alarm or the emergency call button and keep pressing until someone answers. Modern installations have a two-way communication unit that connects to a monitored service, and passengers should be told where they are, who is coming and roughly how long it will be. If nobody answers, that is a fault in the building’s arrangements rather than a reason to try something else, and it is worth reporting once you are out.
If you have a phone with signal, ring the number displayed in the car. If there is no number displayed in the car, that too is worth raising with the building manager afterwards.
Why forcing the doors is the real danger
The instinct to open the doors is understandable and it is the single most dangerous thing a trapped passenger can do. Two things make it hazardous. First, the car may not be level with a floor, which leaves a step or a gap into the shaft. Second, a lift that has stopped on a fault can be restored to service remotely or by someone working at the controller, and a car that starts moving with the doors held open is how people are seriously hurt.
Interlocks exist precisely to prevent this. Defeating them by hand removes the protection that has kept everyone safe up to that point.
Releasing passengers is work for a competent person
Passenger release is a defined procedure carried out by someone trained to do it, using the correct tools, with the car and the drive in a known state. It is not something for a caretaker, a security guard or a helpful bystander, however straightforward it looks. Doing it in the wrong order can drop the car a short distance or start it moving with people half out of it.
What a building should have arranged in advance
- An emergency communication unit in every car that reaches a person who answers, tested regularly, twenty-four hours a day.
- A written release procedure, and a named party responsible for carrying it out.
- A response time for entrapments that is stated in the maintenance agreement in hours, separately from the response time for a lift merely out of service.
- A record of every entrapment, with the cause identified rather than the call simply closed.
That last point is the one most often missed. A single entrapment is bad luck. A pattern of them is a fault that has not been traced, and it will keep happening until someone treats it as a fault rather than as a call-out.
If it keeps happening
Repeat entrapments in the same building almost always have a specific, findable cause: a door detector out of adjustment, a worn contact, a controller responding to a marginal signal. They are fixable. What usually prevents them being fixed is that each call is closed on its own rather than being read as part of a pattern.
If your building has had more than one entrapment in a year, ask for the fault history and ask what root cause was identified. If the answer is that the lift was reset and returned to service, you have not had the problem solved.
Emergency Stops
Every escalator and moving walk has emergency stop buttons, and most people have never noticed them. Knowing where they are, when to use one and what happens next is worth five minutes of anyone’s attention.
Where the stop buttons are
Emergency stop devices are provided at the top and bottom landings of an escalator or moving walk, positioned so that someone standing at the landing can reach one without stepping onto the machine. They are usually red, usually covered by a hinged flap or a transparent guard, and often set low down at the newel or skirting rather than at eye level. On longer units there may be additional devices along the length.
If you manage a building with escalators, it is worth walking to each landing and finding them yourself. If you cannot locate one in a few seconds, neither can a member of the public in an emergency, and that is a finding in itself.
When to use one
Press it when someone is in danger or is caught: a fall, clothing or a shoe drawn into the comb or the skirt, a walking aid or a pram wedged, a child’s hand near the handrail entry. Do not hesitate over whether the situation is serious enough. A stopped escalator is an inconvenience; a running one with someone caught in it is an injury.
It is also reasonable to stop a machine that is visibly faulty — a step out of level, a loose comb, a handrail running at a different speed to the steps — and then report it rather than leave it running.
What happens when you press it
The drive is cut and the brake applies. The machine does not stop instantly and it is not designed to; an abrupt stop would throw people forward. It comes to rest over a short, controlled distance. Anyone standing on it should hold the handrail.
The unit stays stopped. It cannot be restarted by pressing the button again.
Restarting is not a job for the public or the cleaner
Restarting an escalator after an emergency stop requires a check that the machine is clear and undamaged, and it is done with a key by someone authorised to do it. The temptation, once the immediate drama has passed, is to get the escalator running again quickly because it is inconvenient. That is exactly the moment to slow down: something caused the stop, and the machine should not carry passengers again until someone has established what.
What building owners should check
- That every emergency stop device is present, accessible, undamaged and clearly identified.
- That staff who are likely to be first on the scene know where the devices are and are told plainly to use them.
- That a written procedure exists for what happens after a stop, including who may restart the unit.
- That every emergency stop is logged, with the reason, and reviewed rather than simply reset.
The logging matters more than it sounds. Repeated stops at the same landing, or repeated reports of the same behaviour, point at a mechanical cause that is worth finding before it becomes an incident report.
Confined Space
Whether a lift pit or machine room is a confined space is not a matter of opinion, and it is not something to assume either way. It has to be assessed for the specific installation, and the answer changes how work there must be planned.
What a confined space actually is
Under work health and safety law a confined space is an enclosed or partially enclosed space that is not designed or intended primarily to be occupied by a person, is at normal atmospheric pressure while anyone is inside, and has a risk of harm from an atmosphere with harmful contaminants, unsafe oxygen levels, or engulfment. All of those elements matter. A space being small, dark and awkward does not make it a confined space, and a space being reasonably roomy does not automatically exclude it.
Lift pits and machine rooms
Lift pits are the usual candidate. They are below the lowest served level, access is by ladder, ventilation is often limited, and they can accumulate water, oil, refrigerant, exhaust gases from an adjacent car park, or products of a fire. Machine rooms are less commonly classified as confined spaces but are not automatically excluded either, particularly where they are below ground, poorly ventilated, or share air with a plant space.
The point is that the classification depends on the particular installation and its surroundings, not on the type of space in general. Two pits in two buildings can have different answers.
Why it must be assessed rather than assumed
Both wrong answers are expensive. Treating a genuine confined space as ordinary plant space means people enter without an entry permit, without atmospheric testing, without a standby person and without a rescue plan. Treating an ordinary pit as a confined space means every routine attendance carries a procedure it does not need, which drives up cost and, more insidiously, teaches people that the procedure is theatre.
The assessment should be documented, dated, specific to the installation, and available to everyone who works there — including a new maintenance contractor who has never been to the building before.
What follows if it is one
- A written entry permit for each entry, not a standing approval.
- Atmospheric testing before entry and monitoring while anyone is inside.
- A standby person outside the space who stays there.
- A rescue plan that does not rely on the standby person entering the space, and equipment to carry it out.
- Training and competency records for everyone involved.
None of that is exotic. What causes problems is discovering the requirement halfway through a job, or assuming that because the maintenance contractor has always managed, the arrangements must be in order.
What an owner should have in writing
If you have management or control of the building, you carry duties for the safety of this plant whoever else is working on it. At minimum you should be able to produce: the confined space assessment for each pit and machine room, evidence that your contractor’s people are trained for the classification you have, and the rescue arrangements that apply outside business hours.
If you cannot lay your hands on those three documents, that is worth resolving before it is tested by an incident rather than by a question.
On this day
On 23 March 1857 the first Otis passenger lift went into service in a New York department store. What made it possible was not the lift. It was the thing that stopped it falling.
Before the safety gear
Hoists had existed for centuries. What did not exist was any reason for a person to get into one. A rope hoist has a single failure mode and it is catastrophic: if the rope goes, the platform goes with it. Goods were sent up in them. People took the stairs, and buildings stayed low because nobody would climb more than about six storeys to get to work.
What Elisha Otis actually demonstrated
At the New York Crystal Palace exposition in 1854, Otis stood on a raised platform and had the hoisting rope cut. The platform dropped a few inches and stopped. A spring-loaded mechanism, held in tension by the rope itself, released when the rope went slack and drove pawls into ratchets on the guide rails.
The demonstration is remembered for its theatre, but the engineering idea underneath it is the important part and it has not changed: the safety device is armed by the absence of the thing it protects against. Modern safety gear works on speed rather than rope tension, but the principle that the protection engages when the normal condition fails is the same one.
Why it changed cities rather than buildings
Once people would ride, height stopped being limited by how far anyone would walk. Upper floors changed from the cheapest space in a building to the most expensive. The lift did not simply make tall buildings possible; it reversed the economics of them, and the shape of every dense city since follows from that.
Commercially it was slow going. Otis sold very few passenger lifts in the first years. The idea took a generation to become ordinary.
What it means for a building today
Two things carry forward. The first is that lift safety has always depended on layered, independent devices rather than on the primary system being reliable — which is why the condition of the safety gear, the governor and the buffers matters as much as whether the lift is running smoothly, and why they are tested rather than assumed.
The second is that the industry has a long habit of proving things by demonstration. That is still the right instinct. When a contractor tells you a system is compliant and functioning, the reasonable question is how that was verified and what the record shows — which is precisely what witness testing exists to answer.