Elevator that moved with the doors open: bypassed door lock, falsified maintenance records and a dead intercom

Immediate actions:

1. Stop the elevator, switch off and lock the main switch, and tag it out. Do not allow it to be used, even manually, until the safety chain is proven.
2. Inform the user and the owner in writing that the unit is out of service and why.
3. Preserve the evidence: photograph the jumper in place before removal, record its location and the terminal numbers, and note who was present.
4. Report the bypassed safety circuit through the supervisory channel as required for a serious defect; a door-lock bypass on a public elevator is not a minor nonconformity.

Can it run today? No. Removing the jumper only restores the appearance of the circuit; it does not prove that the door lock engages to the required depth, that the electrical contact is made only when the car is in the unlocking zone, or that no other bypass exists elsewhere (car door, landing doors, pit, governor). The whole safety chain must be examined terminal by terminal, each landing door lock checked for engagement and contact timing, and the door operator re-tested. Only then can the functional tests be repeated.

The technician's offer also shows the underlying problem: the same unit that created the defect is proposing to certify its removal. The work must be redone and verified independently.

The records are the second, equally serious finding. Fourteen monthly entries in the same hand and a self-inspection report copied to the decimal place mean the maintenance was not performed, or at least cannot be shown to have been performed. That converts a single bypass into a systemic failure of the maintenance system.

Actions:

• Do not accept the records, do not sign any certificate on the basis of them, and take copies (with date and signature) for the file.
• Record each defect separately: bypassed door-lock circuit; unverified door locks; dead emergency intercom; door closing force 168 N, above the 150 N limit; unverifiable maintenance records; unverifiable annual self-inspection.
• Report the falsification to the user and to the supervisory authority. The maintenance unit's licence and the technicians' qualification are matters for the regulator, not for negotiation on site.
• Require the user to arrange a full maintenance audit of the unit and of the other units in the building served by the same company.

Ethically, an inspector's signature is personal. Signing a document that depends on fabricated records makes the inspector a party to the fabrication, whatever the commercial pressure from the shopping centre's opening hours.

Certification needs the safety chain proven, not just repaired:

• Every landing and car door lock: engagement depth (at least 7 mm), mechanical lock before electrical contact, no possibility of opening from inside a moving car, and correct unlocking-zone behaviour.
• Door closing force re-measured at the final closing point and limited to 150 N; kinetic energy of the closing door within limits.
• Car and counterweight safety gear, governor tripping speed, and the governor rope condition; buffers; ascension/descent and levelling accuracy.
• Brake: sufficient torque, no unintended car movement, and where the design includes it, the unintended-car-movement protection function.
• 125 % rated load test, plus rated-load and no-load runs through the full travel, with the machine-room-less machinery space inspected.
• Emergency intercom and alarm functioning to a manned point, emergency lighting, and the inspection/evacuation instructions.

Documentation: the repair and test records signed by the persons who actually did the work, the maintenance unit's audit result, and a statement of the safety-chain verification. Only after all of this would a certificate be issued, and it should note the prior bypass as a historical defect that has been closed.