Elevator, Fire and Life-Safety System PM

Most preventive maintenance is an economic argument. You service the chiller because servicing it is cheaper than losing it, and if you decide the interval should be six months rather than four because the condition data supports it, that is your call to make and defend. Statutory life-safety PM does not work that way. The fire alarm test interval, the sprinkler inspection frequency, the elevator thorough examination, the emergency lighting duration test: these are set by code, by the authority having jurisdiction, and by your insurer, and the only discretion you have is to do them more often, never less. Get this class of PM wrong and the consequence is not a higher maintenance bill. It is an unattended fire alarm fault on the night it matters, a prosecution, and an insurance policy that does not respond.

The message up front: in life-safety PM the work is not the deliverable, the evidence is. Doing the test and being able to prove you did the test, on the right asset, on the right date, by a competent person, with the defects recorded and closed out, are two different achievements, and only the second one survives an audit or an inquiry. Design the system around the evidence and the work takes care of itself. Design it around the work and you will be reconstructing paperwork under pressure.

1. Why statutory PM is a different class of work

The first thing I try to establish on any CAFM or CMMS engagement that touches life safety is that compliance PM cannot be managed with the same instincts as operational PM. The mental model is different in four specific ways, and each one has a consequence for how you set the system up.

• The interval is fixed externally. On a pump you can move from a calendar interval to a condition-based one if the evidence supports it, and that is good engineering. On a fire alarm system the frequency is written into code or into your fire certificate. Optimising it is not a cost saving, it is a breach. The only legitimate direction of travel is more frequent, never less.
• The competency of the person matters legally, not just practically. For most maintenance, "a technician who knows what they are doing" is sufficient. For statutory work, many regimes require a specific qualification, a third-party certification, or a registered competent person, and the record of who did it is part of the evidence. An unqualified signature can invalidate the whole test.
• The record is the product. A pump service that was done but not recorded is a minor data-quality problem. A fire damper inspection that was done but not recorded is, for every legal and insurance purpose, an inspection that did not happen. You cannot retrospectively assert it.
• The consequence of failure is not financial. Every other PM class trades cost against risk. Here the risk is life, and after life, criminal liability for named individuals in many jurisdictions. That changes who signs off, who escalates, and how fast a defect must be closed.

This is why I always separate life-safety PM in the conversation even when I argue, later in this article, against separating it in the system. The management discipline is genuinely distinct. For the general framework this sits inside, see the complete guide to preventive maintenance and the PM plans and programs framework.

2. Fire detection and alarm systems

The fire detection and alarm system is usually the most heavily prescribed asset in the building and the one most likely to be examined first. It is also the one where the gap between "the system is maintained" and "the system is provably maintained" is widest, because so much of the routine work is done by building staff rather than a contractor.

The work typically splits into three tiers. A frequent user test, commonly weekly in many regimes, where a different manual call point is operated each week on rotation to confirm the panel receives the signal and the sounders operate, logged in a fire logbook. A periodic service by a competent contractor, commonly at quarterly or six-monthly intervals depending on the regime and system type, covering panel functions, batteries, a proportion of detectors, and interfaces to plant. And an annual or full-cycle activity where, in many regimes, every detection device is functionally tested over the course of the year.

The detail that catches people out is cause and effect. A fire alarm system is not just detectors and sounders, it is a matrix of consequences: which detector shuts which damper, releases which door, recalls which lift, starts which pressurisation fan, stops which air handling unit. That matrix was commissioned once, and then the building changed. New tenant partitions, a rerouted duct, a replaced AHU, a lift modernisation. Verifying cause and effect against the current, as-installed matrix is the single most valuable thing in the annual programme and the single most commonly skipped, because it is disruptive and requires coordination across trades. If your annual fire alarm service report does not evidence cause-and-effect verification, ask what exactly was verified.

Evidence to retain: the fire logbook or its digital equivalent with every weekly test and the device tested, contractor service certificates with the engineer named, the device-by-device test schedule showing the annual cycle is complete, the current cause-and-effect matrix with its revision date, and a defect register showing every fault raised, its severity, and the date and means of rectification. The NFPA publishes the family of standards most widely referenced for detection and alarm in the US market and adopted by reference in several other jurisdictions.

3. Sprinklers, risers, hydrants and fire pumps

Fixed water-based suppression is where the physical consequences of neglected PM are most visible, because the failure modes are slow, silent and thoroughly documented: a closed valve nobody noticed, a pump that will not start on demand, a dry riser with a damaged inlet, a corroded pipe in a dry system. None of these announce themselves. All of them are found by routine inspection or found by the fire.

The programme typically layers short-interval visual checks on long-interval physical tests. Weekly or monthly visual inspection of control valves confirming they are open, locked or monitored, gauge pressures within range, and no visible damage or obstruction to heads. Regular pump running tests, commonly weekly churn tests for electric and diesel fire pumps with diesel sets often tested more rigorously because of the fuel, battery and cooling systems involved. Periodic flow testing to confirm the pump still meets its performance curve. Annual inspection of sprinkler heads for paint, corrosion, damage and obstruction, and confirmation that spare heads and the correct wrench are present. Longer-cycle internal pipe inspection, and in many regimes a defined service life after which a sample of heads is tested or the heads are replaced.

Wet and dry risers and hydrants carry their own regime: pressure testing at defined intervals, landing valve inspection, inlet breeching condition, and confirmation that access is not obstructed. The most common real-world defect I see on a walk-round is not a technical failure at all, it is a riser inlet blocked by a skip, a bin store or a parked vehicle. That is an operational discipline problem that no PM schedule fixes on its own, which is why the inspection sheet should force the engineer to record access condition explicitly rather than leaving it to judgement.

NFPA 25 is the reference most often cited for inspection, testing and maintenance of water-based fire protection systems in the United States, and it is adopted or adapted in a number of other markets. It is an example, not a global rule. The UK works from a different body of standards and third-party schemes, and the UAE Fire and Life Safety Code of Practice sets its own requirements. Do not assume an interval from one regime transfers.

4. Fire dampers, fire doors and passive protection

Passive fire protection is the least glamorous and most neglected part of the programme, because nothing about it moves or beeps and its failure is invisible until the day compartmentation is tested for real.

Fire dampers require periodic drop testing to confirm they actually close, typically on a one or two year cycle depending on the regime, with more frequent testing where the damper is in a critical or dirty environment. Two practical problems dominate. Access: a damper behind a plasterboard ceiling with no access panel cannot be tested, and the correct answer is to install an access panel, not to mark it "not accessible" for six consecutive years. And register accuracy: most buildings do not have a complete damper schedule, so the test report covers the dampers that were found, not the dampers that exist. A damper survey that establishes a defensible register is often the necessary first project before any testing programme means anything.

Fire doors need routine inspection of leaf and frame condition, gap tolerances, intumescent and smoke seals, hinges and fixings, self-closing devices, and glazing. Frequency varies widely and often depends on occupancy and traffic, with higher-risk residential and healthcare settings inspected considerably more often than a low-traffic office. Hold-open devices linked to the alarm are both a door item and a cause-and-effect item, and should appear in both tests.

Compartmentation and fire-stopping degrade through ordinary building churn. Every cable pull, every new pipe, every data cabinet installed by a tenant's contractor is a potential penetration of a fire-rated element. A periodic compartmentation survey, and a permit discipline that requires any penetration of a rated element to be made good and recorded, is the only thing that holds the line. This is precisely where a properly enforced permit to work process earns its cost: see permit to work integration with a CMMS.

5. Smoke control, pressurisation and emergency lighting

Smoke control and stair pressurisation systems are tested both as equipment and as a system response. Equipment testing covers fan operation, damper actuation, control panel function and the standby power path. System testing confirms that on a real alarm input the correct fans start, the correct dampers move, the correct doors are released and the achieved pressure differential and door-opening force are within design limits. The pressure differential check is the one most often missing from reports, and it is the one that tells you whether the system would actually work, because a pressurisation system that runs perfectly but does not achieve its design differential protects nobody.

Emergency and escape lighting is the most commonly failed item in my experience of walking buildings, mostly because of battery age rather than anything exotic. The typical regime is a short functional test at frequent intervals, often monthly, confirming each luminaire illuminates on loss of supply, plus a full-duration discharge test at longer intervals, often annually, confirming the luminaire sustains its rated duration, commonly one or three hours depending on the design. The annual test is the one that finds tired batteries, and it is the one people defer because it leaves the building without emergency lighting cover for the recharge period and therefore needs planning.

Two practical points. First, self-testing addressable emergency lighting systems remove most of the labour but do not remove the record-keeping duty, and their logs need to be exported and retained, not merely displayed on a panel that will be replaced one day. Second, the register must match reality: new luminaires added during fit-out works are routinely absent from the test schedule for years. A count reconciliation between the test report and the asset register should be a standing annual check.

Extinguishers follow a similar two-tier pattern: frequent visual checks confirming presence, location, accessibility, seal and gauge, commonly monthly and often done by building staff, and a periodic service by a competent person, commonly annual, with longer-cycle extended service and pressure testing depending on extinguisher type and local requirements. The recurring failure is not the service, it is the visual check. Extinguishers get moved, hidden behind furniture, or used and quietly put back.

6. Elevators, escalators and the thorough examination

Vertical transportation sits slightly apart from the fire systems because it is governed by lifting and machinery regimes as much as by fire codes, and because it almost always runs on a specialist contractor model that changes how you manage it.

There are typically two separate duties, and conflating them is a classic mistake. The first is routine servicing by the maintenance contractor: adjustment, lubrication, door operation, safety-circuit checks, ropes and sheaves, controller and drive, at a frequency set by the contract and the manufacturer's instructions. The second is the statutory thorough examination, an independent inspection of the installation's safety-critical elements by a competent examiner, in many regimes required at defined intervals and, importantly, in several regimes required to be carried out by a party independent of the maintaining contractor. In the UK the LOLER regime is the common example, typically six-monthly for passenger-carrying lifts. Other jurisdictions have their own inspection regimes and their own periodicity, and the UAE and US models differ again. The interval and the independence requirement both need checking locally.

The independence point matters commercially. If the same contractor both maintains and examines, the examination report will rarely be uncomfortable reading. Where the regime allows it, I would still recommend an independent examiner, because the thorough examination is your only structured, adversarial look at an asset that you otherwise entirely outsource.

The fire-related elevator items deserve their own line in the schedule and are often missed by a general lift service: fireman's lift operation and its dedicated switch, fire service recall on alarm activation (which is a cause-and-effect item as much as a lift item), the standby power changeover and which cars it serves, machine-room smoke detection and its interface, shaft pressurisation where fitted, and emergency communication from the car including the auto-dial path, the answering point and out-of-hours coverage. The emergency intercom is the single item I would test most often, because it is the one a trapped passenger depends on and the one most likely to be broken by an unrelated telephony change.

Escalators and moving walks carry their own examination and servicing regime: comb plates, handrail speed and condition, step or pallet integrity, emergency stops, skirt deflectors, braking and anti-reversal. Step and comb defects are the common injury cause, and the daily visual check by operations staff before the unit is put into service is worth formalising as a recorded task rather than a habit.

Refuge points and assistance alarms are the item most frequently absent from any schedule at all. Refuge call points, evacuation chair provision and condition, disabled toilet emergency pull cords and their answering discipline, and the two-way communication path from each refuge to the fire control point. A pull cord that reaches an alarm nobody is responsible for answering is worse than no cord, because it creates a reliance that does not exist. Test it and test who answers.

7. A typical statutory PM schedule (verify every line locally)

The table below is a starting structure, not a schedule you can adopt. Every frequency is described as typical because that is all it is: a commonly encountered interval that you must confirm against local code, the authority having jurisdiction, the manufacturer's instructions and your insurer before it goes into a system. Treat the "competence" column the same way, since who is permitted to sign for a given test varies as much as the interval does.

If you want a structure for turning rows like these into usable engineer-facing documents, the PM checklists and templates guide covers the task-writing discipline, and the same principle applies here with one addition: on a statutory checklist, every line needs a recorded value or an explicit pass or fail, never a tick. A tick proves attendance. A measured door force proves a test.

8. Competency, certification and the contractor model

Life-safety work is almost always delivered through specialist contractors, and the competency chain is part of your evidence whether you manage it or not. The questions worth being able to answer on demand, for every statutory discipline in the building:

• Is the firm approved under whatever scheme the local regime or your insurer recognises? Third-party certification schemes exist in most mature markets, and insurers increasingly specify them. Approval is time-limited, so it needs an expiry date in your system, not a certificate in a folder.
• Is the individual engineer competent for this specific task? Firm-level approval does not automatically make the engineer who turned up qualified for the panel type, the damper type or the examination category. For higher-risk tasks the individual's record matters.
• Is the required independence maintained? Where the regime requires the examiner to be independent of the maintainer, having both under one framework agreement can quietly break that, particularly after a contractor acquisition.
• Does the contractor's own certificate reference the right asset? Certificates that name a building rather than the specific system or device are common and are much weaker evidence. Push for asset-level referencing.
• Who holds the original? If the only signed copy lives in the contractor's system, you will lose access to it the day the contract ends. Every certificate should be ingested into your system at the point of issue.

That last point is the one I would prioritise if you can only fix one thing. A contract change is the most common cause of a compliance evidence gap I encounter, and it is entirely self-inflicted. The SLA matrix design guide covers how to build the obligation to hand over evidence into the contract in the first place rather than negotiating for it at exit.

9. What fire alarm maintenance software actually has to do

This is the section the primary keyword promises, so let me be direct about it. There is a large market of products sold as fire alarm maintenance software, life safety compliance software, or a compliance module bolted onto a CAFM or CMMS platform. Some are genuinely built for this. Many are a standard PM scheduler with a certificate upload field and a compliance-themed dashboard. The difference is not visible in a demo, because a demo shows you the happy path. It becomes visible in an audit.

The capabilities that genuinely matter, in the order I would weight them:

• Immutable test records. Once a statutory test result is submitted it must not be silently editable. If a correction is needed it should be a new, attributed record that supersedes the previous one, with both retained. An audit trail that shows who changed what and when is the difference between a record and an assertion. Ask the vendor directly whether an administrator can edit a completed test result, and whether that edit is visible afterwards. The answer is often uncomfortable.
• Asset-level granularity. The record must attach to the device or the system, not to the visit. "Annual fire alarm service completed" is not evidence about detector L3/D17. A system that cannot carry device-level results cannot support a device-level question, and device-level questions are what get asked after an incident.
• Certificate capture with expiry tracking. Every certificate, whether a test certificate, a contractor approval, an engineer qualification or an insurance-required inspection, has an expiry. The system should track the expiry, warn ahead of it, and escalate past it. Certificates stored as attachments with no expiry field are a filing cabinet with a search box.
• Defect lifecycle tied to the test. A failed test must automatically raise a defect, carry a severity, drive a target rectification time appropriate to the risk, and remain visibly open against the asset until closed with evidence. A test result of "fail" with no linked corrective work order is the most common broken link I find.
• Engineer competency records. The system should know which engineer attended, what they are qualified for, and whether that qualification was current on the date of the test. Ideally it should prevent assignment of a statutory task to an engineer without the matching competency.
• Audit export. The ability to produce, in one operation, a complete evidence pack for a defined scope and date range: schedule, completions, results, certificates, defects and closures. If producing this takes a week of manual assembly, the system is not doing the job, whatever it is called.
• Missed and overdue visibility that cannot be dismissed. Operational PM can tolerate a backlog view. Statutory PM needs overdue items that stay loud, escalate by themselves, and cannot be bulk-closed to tidy a report. If your system allows mass closure of overdue PMs, that function needs to be unavailable for the compliance class.
• Retention aligned to the legal period. Record retention requirements for life-safety evidence commonly run for years and sometimes beyond the life of the contract or the system. A platform whose data retention policy is shorter than your legal duty is a liability, and this includes the archiving behaviour of a hosted service.

On platforms: the major enterprise systems, IBM Maximo, SAP PM, Hexagon EAM, Planon, Infor EAM, can all support this properly, because they have the asset hierarchy, the document management, the work-order discipline and the audit trail to do it, but in most implementations the compliance behaviour is configured rather than delivered out of the box. The mid-market tools, MaintainX, Limble, Fiix, UpKeep, eMaint, have improved considerably on inspection capture and mobile evidence, and for a single-site operation they are often a better fit than a heavyweight platform configured badly. The honest answer is that the product matters less than whether someone configured the compliance class deliberately. I have seen excellent compliance regimes run on modest tools and dismal ones run on expensive platforms. For a structured way to compare, see the CAFM software buyer comparison.

10. Why compliance PM ends up in a separate register, and why that is usually a mistake

In a large proportion of the buildings I have looked at, statutory PM lives somewhere other than the main maintenance system. A compliance spreadsheet held by the health and safety manager. A separate module nobody else has a licence for. The specialist contractor's own portal. A folder of PDFs on a shared drive named by year.

The reasons are always understandable. The statutory work is delivered by contractors who bring their own systems. The person accountable for compliance is often not the person accountable for maintenance. The evidence requirements are different enough that the main CMMS, configured for operational work, does not hold them well. And the compliance manager wants a view that cannot be diluted by three thousand operational work orders.

Each reason is real. The combined outcome is still bad, and here is why:

• The asset register forks. Two lists of the same assets diverge immediately. A device replaced under an operational work order does not appear in the compliance register, so it is never tested. This is the most dangerous single consequence.
• Defects fall between systems. A failed statutory test raises a defect that must be fixed by the operational team, which means a handover between systems, usually by email. Handovers by email have a measurable loss rate, and it is not zero.
• Resource conflicts are invisible. The planner scheduling operational work cannot see that the annual smoke control test needs the same shutdown window, so the two collide and one is deferred. The one deferred is rarely the one with commercial pressure behind it.
• Nobody can see total load. If a third of the real maintenance workload is in a system the planner cannot see, capacity planning is fiction, and the KPI framework reports on a partial estate.
• The separate register decays when its owner leaves. A spreadsheet maintained by one conscientious person is a single point of failure, and it fails silently.

What I would recommend instead is one register and one work-order backbone, with compliance treated as a distinguished class inside it rather than a separate country. Concretely: every statutory asset carried in the same hierarchy as everything else; a work order type or classification that marks compliance work and cannot be created or closed by the same loose rules as operational work; a criticality treatment that puts life-safety assets at the top by definition rather than by score; and role-based views so the compliance manager gets a clean, filtered dashboard without anyone needing a parallel database to produce it. The work order types guide covers the classification mechanics, and asset criticality classification covers why life-safety assets should bypass the usual scoring.

The one legitimate exception: where a regulator or insurer mandates a specific external system or portal, you have to use it. In that case, do not treat it as your register. Treat it as a reporting destination, keep your own asset-level record in the main system, and reconcile the two on a defined cycle. Never let an external portal be the only place a test result exists.

11. Running an audit-ready regime

The practical habits that separate an operation that passes inspection calmly from one that spends a fortnight assembling evidence:

• Reconcile the register annually against physical reality. Device counts against the panel, luminaire counts against the test report, damper counts against the survey, doors against the schedule. Any discrepancy is a finding before an auditor makes it one.
• Record values, not ticks. Measured pressure differential, achieved emergency lighting duration, door closing force, pump start time. Values can be trended and defended. Ticks cannot.
• Close the loop on every failed test in a defined time. Severity-driven rectification targets, with the asset flagged as impaired until closed, and a documented interim measure such as a fire watch where a system is out of service.
• Track impairments formally. Any period where a life-safety system is isolated, whether for works or because of a fault, needs a recorded impairment with start, reason, compensating measure, authorisation and restoration. Insurers frequently require notification, and this is a common policy-condition breach.
• Keep the cause-and-effect matrix under revision control. It is a live document. If its last revision predates the last fit-out, it is wrong.
• Do a dry-run audit yourself once a year. Pick five devices at random and try to produce three years of evidence in an hour. What breaks in that exercise is what will break for real.
• Read your insurance policy conditions. They frequently impose obligations beyond code, and they are the terms under which a claim will actually be assessed.

Electrical safety testing sits adjacent to all of this and shares the same evidence discipline, covered separately in the electrical PM and PPM checklists guide. For international standards context beyond the fire codes, the ISO catalogue is a useful reference point, though again, none of it displaces the local code that actually applies to your building.

The idea to walk away with

Life-safety PM is the one class of maintenance where the schedule is not yours to optimise and the record is the thing you are actually producing. The interval comes from code, the authority having jurisdiction and your insurer. The competence requirement comes from the same place. The evidence has to be asset-level, attributable, immutable, retained for the legal period, and retrievable in an hour by someone who is not you.

Everything else follows from accepting that. It is why the asset register has to be verified before the software matters. It is why a failed test must automatically become a tracked defect. It is why the compliance work belongs inside the same register as everything else, visible to the planner, rather than in a parallel spreadsheet that forks from reality the first time a device is replaced. And it is why "we do all our statutory maintenance" and "we can prove we did all our statutory maintenance" are two different claims, and only the second one is worth anything when it is tested.

Final thoughts

If you take one action from this article, make it the dry-run audit. Pick five assets across five different systems, a detector, a damper, an emergency luminaire, an extinguisher and a lift, and try to assemble three years of evidence for each: who tested it, when, under what qualification, what the result was, what defects arose and when they were closed. The exercise takes an afternoon and it will tell you more about your compliance position than any dashboard.

And then check your intervals. Not against this article, not against a template inherited from another building or another country, but against the code that applies where you are, the conditions attached to your building's fire approval, and your insurance policy. The interval is the one thing in this whole discipline that you must never assume, and it is the thing most often copied without checking.

Related reading: Preventive maintenance: the complete guide, PM checklists, templates and examples, Permit to work integration with a CMMS, Work order types in a CMMS, Asset criticality classification, Electrical PM and PPM checklists.