Elevator door interlocks are the mechanical and electrical safety devices that lock every hoistway door shut and cut power to the elevator motor unless every door in the building is fully closed and latched. They exist because, before interlocks became mandatory, roughly a third of all elevator fatalities involved someone falling into an open shaft. Modern safety codes built around ASME A17.1 now require them on every passenger elevator, and building owners who let them fall out of compliance face shutdown orders and fines.
What an Interlock Actually Does
Each interlock performs two jobs at once. It keeps the car from moving unless every hoistway door in the building is closed and mechanically locked, and it prevents anyone from opening a hoistway door from the hallway unless the car is parked directly behind that door. Those two functions address the two scenarios that historically killed the most passengers: a car departing while someone is stepping in, and a person pulling open a door onto an empty shaft.
The system runs as a single series circuit. The elevator controller monitors every interlock in the building as one continuous electrical loop, and if any device in that chain opens, the entire loop breaks and the car stops. One failed interlock anywhere in the building shuts down the whole elevator. That is the design, not a flaw.
The Parts That Make Up an Interlock
A working interlock combines mechanical and electrical components that must act in sequence. The mechanical latch, sometimes called a beak, hooks into a striker plate on the hoistway door frame and physically prevents the door from sliding open. When the beak seats fully, it pushes a pair of electrical contacts together, completing that door’s portion of the safety circuit. If the beak doesn’t seat, the contacts stay apart and the elevator will not run.
On the car itself, a door clutch engages pickup rollers mounted on each hoistway door. When the car arrives at a floor, the clutch expands to grab the rollers and pull the beak out of its housing, unlocking that specific landing door. Only the car can initiate this. If the car is between floors or at another landing, the clutch and rollers never meet, and the door stays locked. The clutch geometry also enforces leveling accuracy, because the unlocking action only works when the car sill lines up with the landing sill within a narrow tolerance.
The car has its own device called a car door contact, or gate switch, that confirms the car’s own doors are closed. It sits in the same series circuit as every hoistway interlock. One side protects the shaft; the other side protects the car. Both must be closed before the controller sees a complete circuit.
What ASME A17.1 Requires
ASME A17.1, published jointly with CSA B44 for Canadian compliance, is the national safety code for elevators and escalators in the United States. It covers design, construction, installation, operation, inspection, testing, maintenance, alteration, and repair.1The American Society of Mechanical Engineers. A17 Elevators and Escalators Offerings The most recent edition is ASME A17.1-2025, which forms the basis for state and local elevator codes across the country.2The ANSI Blog. ASME A17.1-2025 Safety Code for Elevators and Escalators States do not always adopt the latest edition immediately, so the version in force depends on which edition your local authority having jurisdiction (AHJ) has adopted.
Section 2.12 of the code contains the core interlock requirements. Every type and make of hoistway door interlock must be of an approved type, meaning it has passed third-party testing and certification before it can be installed. The code also sets the unlocking zone at no less than 75 mm (3 inches) and no more than 450 mm (18 inches) above and below the landing floor level. Outside that zone, hoistway doors cannot open more than 100 mm (4 inches) from inside the car, a restriction enforced by door-restrictor hardware. These dimensions prevent anyone from forcing a door wide enough to fall through when the car isn’t at the landing.
The code also mandates a failsafe design philosophy. If an internal spring breaks, a contact welds shut, or wiring degrades, the default state must be an open circuit that stops the elevator. No failure mode is permitted to leave the car running with unlocked doors. That principle applies to every component, from the beak to the electrical contacts.
Door Lock Monitoring and the Bypass Problem
Standard interlocks have a blind spot. They can be defeated by an electrical bypass. If someone bridges the wiring around an interlock contact, the controller sees a complete circuit even though the door isn’t actually locked. This was historically the most dangerous shortcut in the elevator industry, and it contributed to a disproportionate number of serious accidents.
ASME A17.1 section 2.26.5 addresses this with a requirement called door lock monitoring (DLM). A DLM system independently verifies the physical position of the car doors while the car is in the landing zone. If the car door is fully open but the safety circuit shows the door contact closed, the DLM system detects the contradiction and prevents operation. It also blocks the doors from power-closing if it senses that either the car door contact or the coupled landing door interlock contact has been bypassed. That catches both intentional tampering and wiring failures that silently bridge the circuit.
DLM applies to all automatic passenger and freight elevators with power-operated car doors that are mechanically coupled to the landing doors. Elevators with controllers manufactured after roughly 2007 usually have DLM built into the controller logic. Older systems need to be evaluated, and often retrofitted.
Older Elevators and Retrofit Rules
ASME A17.3, the companion code for existing elevators and escalators, sets retroactive requirements for equipment already in service. Section 3.10.12 requires door lock monitoring on all automatic passenger and freight elevators with power-operated car doors mechanically coupled to landing doors. The system must prevent the car from running if the car door is not closed, regardless of what the interlock contacts report, with narrow exceptions for car-leveling devices, hoistway access switches, and inspection modes.
Owners of older buildings should pay attention here. An elevator that passed inspection for decades under earlier code editions can be flagged as noncompliant when the AHJ adopts a newer edition of A17.3. The evaluation hinges on the controller’s age and capabilities. Controllers installed before approximately 2007 generally need a professional assessment to determine whether they already include DLM or require hardware and software upgrades. Retrofit cost varies with the elevator’s age and configuration, but it is almost always less expensive than being ordered to shut the elevator down until the work is done.
Inspection and Testing
Elevator inspectors follow procedures laid out in ASME A17.2, the companion guide that standardizes how inspections and tests are performed. Inspectors and inspection supervisors must hold certification through an organization accredited by ASME’s Qualifications for Elevator Inspectors Committee, typically the Qualified Elevator Inspector (QEI) designation administered by NAESA International.3NAESA International. QEI Certification The QEI exam covers ASME A17.1, A17.2, A17.3, and several related codes, and inspectors must also be recognized by the local AHJ.
A standard interlock inspection starts with a pull test. The inspector goes to a landing where the car is not present and tries to force the hoistway door open by hand. The mechanical latch must resist that force without yielding. If the door opens or flexes beyond what the code allows, the interlock fails on the spot. The inspector also checks the electrical side with a multimeter, looking for any sign that a contact has been bridged or bypassed. Carbon buildup on contact surfaces, worn beak tips, and misaligned pickup rollers are common findings.
Periodic inspections involve cycling the car to every floor and verifying that each car sill aligns with the corresponding landing sill within tolerance. The inspector confirms that each hoistway door locks when the car departs and that the interlock contact opens cleanly when the door is disturbed.
Owner Maintenance Duties
ASME A17.1 section 8.6 requires a written Maintenance Control Program (MCP) for every elevator. The MCP must be provided by the maintenance contractor or the building owner and kept viewable on-site at all times by elevator personnel, inspectors, and the AHJ. It must list every maintenance task, examination, test, and adjustment required by the code, along with the intervals at which each must occur. Those intervals are not one-size-fits-all. They factor in equipment age, condition, accumulated wear, usage patterns, environmental conditions, and manufacturer recommendations.
For interlocks, the MCP should spell out scheduled inspection of beak engagement, contact resistance, clutch-to-roller alignment, and DLM functionality. Maintenance records must document the description and date of every task performed, every repair or replacement, and every trouble call along with the corrective action. Records must be retained for at least five years and remain accessible on-site in hard copy or via an internet-enabled device.
If a technician identifies a defective interlock, or any part that directly affects safe operation, the code requires taking the elevator out of service immediately until the part is adjusted, repaired, or replaced. Owners without a current MCP, or with incomplete records, face violations and potential shutdown. The MCP is one of the first things an inspector reviews, and gaps in it are treated as evidence that the underlying maintenance may be deficient.
When an Interlock Fails Inspection
An interlock that does not cleanly break the safety circuit when the door opens is an automatic failure. There is no gray area. The inspector can order the elevator out of service immediately, and the AHJ can issue what is commonly called a red tag, a formal notice prohibiting use until repairs are complete and verified. The owner must hire a licensed elevator contractor to make the repair, document the work in the maintenance records, and schedule a re-inspection. Timelines vary by jurisdiction, though most AHJs expect it within 30 to 60 days.
Fines for code violations also vary. Some states impose penalties per violation per day of noncompliance, and the amounts escalate quickly when a building has multiple elevators or when the owner has been warned before. Beyond fines, owners face serious liability exposure. If an accident occurs and the investigation reveals a failed interlock that should have been caught during routine maintenance, the owner’s position is extremely difficult to defend. A current MCP, clean records, and prompt responses to inspection findings are the minimum steps to manage that risk.
After a successful repair and re-inspection, the inspector updates the elevator’s certificate of operation, which must be posted inside the car. An expired or missing certificate is itself a violation in most jurisdictions and signals to occupants and fire officials that the elevator’s safety status is uncertain.
Fire Service Exceptions
Interlock behavior changes during a fire emergency. In Phase I Emergency Recall, cars return to a designated recall floor, usually the ground level, and the car doors and associated hoistway doors are permitted to remain open. That is an intentional exception. Firefighters need immediate access to the car without waiting for doors to cycle, and open doors at the recall floor keep the car available for Phase II operations.
During Phase II, a firefighter takes direct control from inside the cab using a key switch. The doors open and close only while the firefighter holds the button, and the car travels only to floors the firefighter selects. DLM’s normal bypass-detection rules are relaxed in Phase II to allow operation with doors partially open when necessary. These exceptions are tightly defined in ASME A17.1 and do not apply outside genuine emergency conditions.