The dispatch AI gets the headlines. Most of the code is a very careful answer to one question: what mode am I in right now, and what am I allowed to do in it?

The short version

• A modern controller is a state machine. Normal service is just one state out of many.
• Fire Phase I recalls every car to a safe floor. Fire Phase II hands one car to a firefighter with a key, and the controls change behavior.
• Inspection mode lets mechanics ride the car top at a crawl. Earthquake and emergency power modes decide who moves and when.
• The firefighter’s key was standardized in many places so any fire crew could use any building’s elevators. Security researchers have pointed out the obvious downside.
• The service tools that read fault codes and change parameters are often proprietary, which has turned elevators into a right-to-repair fight.

Fire service, up close

Fire codes treat elevators as something to take out of public use during a fire, not an escape route. Shafts can fill with smoke, power can fail, and water from sprinklers and hoses gets everywhere. So:

• Phase I (recall). Triggered by a smoke detector in a lobby, machine room, or shaft, or by a key switch at the fire recall floor. Cars cancel every call, head for the designated floor (or an alternate floor if the smoke is at the main floor), open, and park. The light-curtain door sensors are typically switched off in this mode, because smoke can block the beam and hold the door open forever.
• Phase II (firefighter operation). A firefighter gets in and turns the in-car key. Now the car answers only its own buttons. The doors open only while the firefighter holds the button, and if they let go early the doors close again, so a firefighter can peek at a smoky floor and back out. Here, finally, the door close button does exactly what it says.

Some newer high-rises go further with occupant evacuation operation, where protected elevators help empty the building under tightly controlled conditions. Codes and local adoption vary, so it’s not everywhere.

The key problem

For firefighters to use Phase II, they need a key that works. In many jurisdictions that means a standardized fire service key, so a crew doesn’t need a ring of hundreds. Security researchers Deviant Ollam and Howard Payne spent a DEF CON 22 talk walking through elevator terminology, modes, and controls, and the tension is easy to see. A key every firefighter can carry is a key other people can get too. We’re not going to describe the key. The public talk is the right place to go for the security side.

▶

Tech tools and the right-to-repair fight

On older equipment, a skilled mechanic could fix almost anything with a meter and a wiring diagram. On a lot of newer proprietary controllers, you can’t even read the fault log without the manufacturer’s service tool. Depending on the brand, that’s a handheld unit, a laptop app, or a key-card, and independent elevator companies say they either can’t get one or can only lease one on the manufacturer’s terms.

Elevator World and independent contractors describe the same pattern as the car and tractor right-to-repair fights. Building owners who want to switch maintenance companies can find the new company locked out of their own equipment. The counter-move is open-architecture controllers from independent makers, sold on the promise that any licensed mechanic can service them with published tools. That’s also why “modernization” jobs so often replace the whole controller.

Sources

1. UpCodes: ASME A17.1 Section 2.27, emergency operation and signaling devices
2. DEF CON 22: Ollam & Payne, Elevator Hacking (slides, PDF)
3. Elevator World: The Right to Repair
4. Elevator Blueprint: OEM vs. independent elevator companies