Elevator Phase I emergency recall operation is an automated safety mode that pulls every elevator car out of normal service the moment fire-related sensors trip, cancels all pending calls, and sends the cars to a designated floor with the doors held open. Nobody has to push a button or make a call for it to happen. The sequence is governed by the ASME A17.1 Safety Code for Elevators and the NFPA 72 Fire Alarm Code, and it exists for one reason: to keep passengers from being trapped in a shaft during a fire and to hand the cars over to arriving firefighters in a known, safe state.
What Triggers Recall
Recall begins when smoke or heat detectors wired into the building’s fire alarm panel sense fire conditions near the elevator system. The detectors sit in three code-required zones: the elevator lobby on each floor, the machine room or machinery space, and the hoistway itself. Lobby detectors catch fires that could threaten waiting passengers. Detectors in the hoistway and machine room catch fires that could disable the elevator while people are inside.
The type of detector is matched to the space. Elevator lobbies use photoelectric smoke detectors, which respond well to the smoldering fires common in occupied areas. Machine rooms and hoistways often pair smoke detectors with heat detectors, particularly where sprinklers are installed. When sprinklers sit at the top of a hoistway, a heat detector must be within two feet of each sprinkler head, and a smoke detector must be within twelve inches of the hoistway ceiling.1Pennsylvania Automatic Fire Alarm Association. Elevator Hoistway Fire Alarm Detection Accessibility Designs for Compliance with the New NFPA 72 Requirements A shaft behaves like a chimney, so conditions at the top can differ sharply from the bottom.
Heat detectors in machine rooms are commonly rated at 135°F, well below the 212°F activation temperature of a typical sprinkler head. That lower threshold triggers recall before sprinkler water reaches the elevator’s electrical components. Once any qualifying sensor trips, the fire alarm panel signals the elevator controller and the recall sequence starts. NFPA 72 does permit time delays for certain sensor types, such as waterflow switches, to prevent false recalls from pressure fluctuations.1Pennsylvania Automatic Fire Alarm Association. Elevator Hoistway Fire Alarm Detection Accessibility Designs for Compliance with the New NFPA 72 Requirements
What the Elevator Does Once Recalled
The controller abandons whatever the car was doing. Every hall call and every button pressed inside the cab is canceled instantly. The car will not stop for waiting passengers no matter how many times the button is pressed.
If the car is already moving toward the recall floor, it runs express past every intermediate stop. If it is traveling away from the recall floor, it stops at the next available landing without opening its doors, reverses, and heads straight to the designated level.2UpCodes. Phase I Emergency Recall Operation The doors stay shut at that intermediate stop because the system has no way of knowing whether the hallway on that floor is filled with smoke.
When the car arrives, the doors open and stay open. Anyone still inside can walk out. The cab then sits idle with its doors held wide, waiting for a firefighter to take manual control or for the system to be reset. That parked-and-open state is deliberate: it keeps the car from drifting to a dangerous floor and it tells arriving crews the elevator is available.
Primary and Alternate Recall Floors
The recall floor is almost always the main lobby, or whichever level provides the most direct path to the street. Passengers get out at the easiest exit point, and firefighters find the cars where they enter the building.
If the lobby itself is the source of the fire, sending cars there would be catastrophic. Since 1981, the ASME A17.1 code has required an alternate recall floor for exactly that scenario.3National Institute of Standards and Technology. Alternate Floor Recall Provisions for Elevators Should Be Maintained When the smoke detector at the primary recall level is the one that triggered the alarm, the system automatically redirects every car to a pre-programmed alternate, typically one floor above or below the lobby, chosen for its own access to exits.
A NIST analysis of the provision put the logic plainly: if there is smoke at the designated level, returning elevators there makes them a “potential killer,” and diverting to an alternate floor is the better approach.3National Institute of Standards and Technology. Alternate Floor Recall Provisions for Elevators Should Be Maintained The alternate designation is not paperwork; it is one of the system’s most important safety layers.
The Three-Position Key Switch
Automatic sensor activation handles most real emergencies, but firefighters and building personnel also need a way to trigger or cancel recall by hand. That control lives in a physical key-operated switch, typically mounted in the main elevator lobby or the fire command center. It has three positions.4ASME. ASME A17.1 Safety Code for Elevators and Escalators
- Off is normal operation. Cars respond to hall calls and cab buttons as usual.
- On manually triggers Phase I recall regardless of what the sensors are reading. Fire crews use this when they know conditions require recall even if detectors have not tripped yet.
- Bypass is a temporary override that prevents recall during planned testing or maintenance, keeping the elevator running normally while technicians work on the fire alarm system.
The switch uses a standardized key, the FEO-K1, a tubular seven-pin design with a specific bitting pattern. Possession is restricted to elevator technicians, emergency personnel, equipment manufacturers, and other authorized individuals.5UpCodes. Phase II In-Car Operation Every elevator in a building uses the same FEO-K1 keyway, so a single key operates all the switches, and fire departments carry these keys as standard apparatus equipment. A random building occupant cannot start or cancel recall.
The Fire Hat Indicator
Inside the cab, a small illuminated symbol shaped like a firefighter’s helmet tells arriving crews whether the elevator is safe to use. Its two states carry very different meanings.
- Solid light means the elevator is in recall mode. Phase I has activated, the car is at or heading to the recall floor, and the system is working as designed. Firefighters can proceed with Phase II operation.
- Flashing light means fire may be present inside the hoistway or machine room. A sensor in one of those spaces has tripped, so the shaft itself could be compromised. Firefighters are trained to avoid using the car when this light flashes, though they retain the ability to override if the situation demands it.
A hallway fire is not the same problem as a fire in the elevator shaft. A hallway fire triggers recall through lobby detectors and produces the solid indicator. A hoistway or machine room fire means the elevator’s own infrastructure may be failing. Every elevator installed since 2004 with sprinklers in the hoistway or machine room is required to have the flashing indicator.
Lobby Signage
Building codes require a sign posted next to the hall call buttons on every floor directing occupants away from elevators during a fire. The International Building Code version reads “IN CASE OF FIRE, ELEVATORS ARE OUT OF SERVICE. USE EXIT STAIRS.” The International Fire Code version reads “IN FIRE EMERGENCY, DO NOT USE ELEVATOR. USE EXIT STAIRS.” ASME A17.1 provides a standardized design of its own but defers to whichever version the local building code adopts. A missing or illegible sign is one of the easiest citations for an inspector to write.
Where Phase I Ends and Phase II Begins
Phase I gets the elevator to the recall floor and parks it. It does not give firefighters the ability to move the car. That is Phase II: a firefighter steps into the cab, inserts the same FEO-K1 key into a switch inside, and takes direct manual control.5UpCodes. Phase II In-Car Operation In Phase II, the elevator ignores hall calls entirely, the firefighter drives it with the cab buttons, and the doors only stay open while a button is held. If the button is released and the cab senses heat or smoke, the doors close on their own.
The International Building Code requires both Phase I recall and Phase II in-car operation for elevators within its scope.6UpCodes. IBC 2024 Chapter 30 – Elevators and Conveying Systems These are baseline requirements for virtually every commercial elevator installation, not optional upgrades.
Monthly Testing and Documentation
A recall system that has not been tested is a system nobody can trust. ASME A17.1 requires monthly testing of both Phase I and Phase II by authorized personnel. Each monthly test must include triggering Phase I recall using the lobby key switch and running at least one floor of Phase II in-car operation.7National Elevator Industry, Inc. Matrix of Elevator and Escalator Related Requirements in the Model Codes vs ASME A17.1 CSA B44 and A17.3 Any deficiencies must be corrected, and results must be documented in a record available to elevator personnel and the local authority having jurisdiction.
The documentation catches many building operators off guard. A test log must record the date, pass or fail for Phase I, pass or fail for Phase II, the status of the two-way communication system, and the initials of the person who performed the test. Logs are typically kept in the machine room or maintained electronically so the maintenance contractor, the inspector, and building management can all reach them. If the fire service test or two-way communication fails, the maintenance contractor’s contact information must be recorded for reporting the failure.
Inspectors reviewing these logs are not just checking boxes. A pattern of failures, gaps in testing dates, or missing entries suggests the building is not maintaining the system, and that is where enforcement begins. Each test itself takes only a few minutes per car.
Penalties for Non-Compliance
Fines for elevator safety code violations vary by jurisdiction. Depending on the locality and the severity of the violation, penalties can range from a few hundred dollars to tens of thousands of dollars per incident. Operating an elevator with a non-functional fire recall system, missing test logs, or failed sensors is a serious code violation because it directly compromises life safety.
The financial exposure goes past administrative fines. If a fire occurs and the recall system fails because of deferred maintenance or ignored inspection findings, the building owner faces potential negligence claims from anyone harmed. Insurers also scrutinize elevator compliance records when processing claims after fire events, and documented code violations can become grounds for denying coverage.