Key takeaways:
- A floor schedule combines three separate rules: who is using the credential, which floors they may access, and when that access applies.
- The elevator architecture determines what a schedule can actually control, so software features must be checked against the controller, wiring, integration method, and contractor scope.
- Emergency operation, accessibility requirements, outage behavior, and retrofit limits must be planned and tested before scheduled floor control is treated as ready for use.
A floor schedule sounds simple: let the right people reach the right floors at the right times. In an elevator, though, that rule has to pass through several layers before a button, destination terminal, or hall call responds the way the property expects.
Elevator access control by floor schedule authorizes a credential or access group for specific floors only during defined time windows. The access-control and intercom system checks who is presenting the credential, which floor they are allowed to reach, and whether the request falls inside the approved schedule. Then the elevator hardware or approved integration has to enable the permitted selection.
That last step is where many projects get complicated. A schedule that looks clean in software still has to match the elevator controller, wiring path, fire-service behavior, accessibility requirements, and retrofit plan. This guide explains how those pieces fit together so property teams can evaluate floor-by-schedule access without turning the project into a broad elevator security overhaul.
This guide will answer:
- What elevator access control by floor schedule means
- How to configure a time-based floor restriction
- Which elevator architectures support scheduled floor control
- How credentials and property use cases affect schedules
- How emergency overrides, accessibility, and failover shape the design
- What determines retrofit feasibility and cost
- What scheduled floor control does not solve
- How to choose the right setup for your property
- Where ButterflyMX fits in a floor access workflow
- FAQs
Watch how ButterflyMX works:
What elevator access control by floor schedule means
A floor schedule is a time rule that works alongside credential and floor permissions. It can authorize a resident, employee, tenant, contractor, or access group to select certain floors during a recurring window or a defined exception period, as long as the selected access platform and elevator integration support that configuration. Documentation from Kisi and Keri Systems shows this general pattern for elevator access groups and schedules.
The cleanest way to understand the rule is to separate it into three checks:
- Credential permission decides whether the card, fob, mobile credential, or PIN is valid for that person or group.
- Floor permission decides which destinations that person or group may use.
- The schedule decides when that otherwise valid floor permission applies.
Changing one layer does not automatically change the others. A staff credential might remain active at the front entrance all day while its access to a service floor ends at 6 p.m. Likewise, a standing recurring floor schedule is not the same as a temporary visitor credential or an intercom-triggered elevator event. A platform may support one of those patterns without supporting all of them.
That distinction keeps the article focused on scheduled floor restrictions rather than elevator security in general. For the broader category, see ButterflyMX guidance on elevator access control.
How to configure a time-based floor restriction
The menu names vary by access-control platform, but the planning work is usually similar. Start with the access policy, not the software screen. The elevator can only enforce permissions that have been designed clearly and connected to the elevator system correctly.
- Choose the user or access group. Separate residents, building staff, vendors, tenants, and temporary contractors when their floor needs or hours differ.
- Confirm the credential rules. Decide which credential types the group may use and how lost, replaced, suspended, or expired credentials are handled.
- Assign the permitted floors. Identify the actual destinations the group needs, not just the elevator car they may enter.
- Attach the time rule. A recurring rule might allow cleaning staff to access office floors on weekdays from 6 p.m. to 10 p.m.
- Add exceptions or holidays. A one-time contractor visit, holiday closure, or special event can adjust the normal rule for a defined period without rebuilding the base schedule.
- Test the rule at the elevator. Check an approved time, a denied time, an exception date, each intended floor, and any floor that should remain unavailable.
- Review the event records. Confirm that the system logs the credential, floor, time, and result in a way the property team can understand and audit.
Common schedule types include recurring weekly schedules, single-event schedules, exceptions, and holiday overrides. The names and exact behavior differ by vendor, so administrators should verify rule precedence, time zone handling, automatic expiration, overlapping schedules, and audit-log visibility in the selected platform. The practical question is not only whether a schedule can be created. It is what happens when two rules touch the same credential, floor, and time window.
Which elevator architectures support scheduled floor control
A schedule only matters if the access-control system can pass an approved decision to the elevator. That is why elevator architecture is just as important as the schedule feature in the software. The following table is a practical comparison framework, not a complete engineering taxonomy.
A relay floor lockout typically uses access-control outputs to enable or disable floor-selection circuits serving the car operating panel. Destination dispatch works differently: the rider requests a destination at a terminal, and the authorized destination has to coordinate with the elevator group-control environment. Landing or hall-call restriction controls access before or at the point where a rider summons service from a landing.
Elevator access-control guidance from Avigilon and a Swiftlane overview of elevator-control approaches describe common ways floor access can be enforced. But no row in the table is a default winner. The right approach depends on the existing controller, elevator layout, required schedule detail, threat model, approved interfaces, and the elevator contractor or manufacturer requirements.
In-car restriction and landing restriction also answer different access questions. In-car control can limit which button or destination a rider selects after entering the car. Landing control may matter when the property needs to control who can call the elevator from a particular floor or when an indirect route would weaken an in-car-only design.
How credentials and property use cases affect schedules
The credential identifies or authorizes the user. The floor and time rules decide where that credential works and when it works there. A mobile credential, card, fob, or PIN can be the input to the same policy model, but the credential type alone does not solve shared credentials, tailgating, or indirect routes to a restricted floor.
In a multifamily building or HOA property, scheduled floor access may be used for amenity floors, staff-only areas, delivery windows, or temporary guest access. For example, residents might have daytime access to a shared amenity floor, while maintenance staff might have a different schedule for service areas. Visitor access is a related but separate use case. For a visitor-side example, see ButterflyMX information on visitor elevator floor access.
Office and mixed-use buildings often need a different set of rules. A property may separate tenant floors, limit contractors to defined work windows, or apply different schedules to residential and commercial groups in the same building. Those policies still follow the same credential-floor-time model, but the groups, floors, and exceptions become more complex.
Intercom-triggered elevator access is another distinct pattern. It can help when a visitor calls a resident and the resident grants access from a smartphone, but that does not automatically mean the same system supports a standing recurring floor schedule. ButterflyMX explains the related category in its guide to intercom integration with elevator controls.
How emergency overrides, accessibility, and failover shape the design
Scheduled elevator restrictions must not interfere with required emergency operation. Fire-service Phase I recall and Phase II in-car operation supersede ordinary access restrictions during a fire-service event. NFPA guidance on firefighter use of elevators explains the role of these fire-service phases. The project team should verify the locally adopted elevator code, fire alarm requirements, elevator configuration, and authority having jurisdiction requirements for the property.
That review may involve ASME A17.1/CSA B44, NFPA 72, local amendments, and the specific fire alarm and elevator design. The article is not a substitute for code, engineering, or authority having jurisdiction review. The important planning point is simple: a configured access schedule should not be treated as something that can block required fire-service operation.
A schedule also does not establish ADA compliance. The applicable requirements for elevator operable parts, controls, destination-oriented systems, signage, and relevant two-way communication remain separate from the access policy. Consult the 2010 ADA Standards for Accessible Design and qualified project reviewers for the requirements that apply to the installation and jurisdiction.
Failover behavior needs the same discipline. Do not assume the system will fail open or fail secure during power loss, network loss, controller failure, or recovery. Document what happens to elevator operation and access records in each condition, then test those scenarios with the appropriate elevator contractor and fire, accessibility, and code stakeholders. A rule that works during a normal weekday is not complete until emergency and recovery behavior have been witnessed and accepted.
What determines retrofit feasibility and cost
Retrofit feasibility starts with the elevator equipment, not with the schedule template. Controller compatibility, the selected integration point, available wiring, traveling-cable capacity, relay or interface requirements, and the condition of existing equipment can all change the project scope. A practitioner discussion on elevator access-control retrofit concerns highlights why control-board integration and call-button-level wiring should be treated as model-dependent possibilities, not assumptions.
The main cost drivers are usually practical ones:
- How many elevators, cars, banks, landings, or destination terminals must be controlled.
- Whether the existing controller supports the chosen access-control interface.
- Whether wiring, relay capacity, or traveling-cable capacity is available and approved.
- How much work must be performed by the elevator contractor, access-control installer, manufacturer, or other approved parties.
- How much testing, documentation, emergency review, and authority having jurisdiction coordination the project requires.
One vendor review of installer quotes from 2023 through 2026 reported an approximate range of $3,000 to $12,000 or more per elevator. That published cost context should not be treated as an industry benchmark. Pricing can change with equipment, labor, integration complexity, building conditions, and local requirements, so project teams should recheck current costs before using any range for budgeting.
What scheduled floor control does not solve
A floor schedule is a useful policy control. It is not a complete security program. Scheduling may limit when a credential can select a floor, but it does not by itself stop every way a person might reach or attempt to reach a restricted area.
- Tailgating can still occur when an unauthorized person follows an authorized rider.
- Indirect routes may matter if stairs, shared corridors, or other access points reach the restricted floor.
- Hall-call bypass concerns can remain when control is only applied inside the elevator car.
- Emergency-related access and fire-service-key procedures need separate life-safety review.
Those are possible design and operating concerns, not claims about how often they occur at every building. Use the property threat model to decide whether in-car restriction is enough or whether landing controls, door controls, staffing practices, or other measures need separate evaluation. Stairwells, egress doors, and any related locking decisions must be reviewed for life-safety and authority having jurisdiction requirements.
Administration matters, too. Assign ownership for schedules, expire temporary credentials, review exceptions, perform periodic permission reviews, and monitor audit logs for activity that does not match the intended policy. Without that operating discipline, even a well-designed schedule can drift away from how the property is actually used.
How to choose the right setup for your property
Start with the property use case, then validate the elevator architecture. A multifamily or HOA building may need rules for residents, visitors, deliveries, staff, and amenity floors. An office or mixed-use building may need tenant separation, contractor expiration, shared-floor rules, and different schedules for residential and commercial groups. The best policy is not the most complicated one. It is the one the property can explain, test, audit, and maintain.
Evaluation checklist
- Can the selected platform apply permissions by user or group, floor, and schedule?
- Does it support the recurring, one-time, exception, and holiday patterns the property actually needs?
- Which elevator control point is available: car operating panel, in-cab reader, destination dispatch, or landing?
- Has the elevator manufacturer or contractor confirmed controller compatibility, wiring, traveling-cable capacity, and approved interfaces?
- What are the documented behaviors for fire service, power loss, network loss, controller failure, and recovery?
- Will the system provide the credential flexibility and audit records needed for administration and investigation?
- Who owns schedule updates, exception approvals, emergency review, and ongoing permission audits?
Acceptance tests to plan
- Approved access during the normal schedule.
- Denied access outside the normal schedule.
- Correct behavior on an exception date or holiday rule.
- Correct floor enablement for each intended user or access group.
- Emergency override, outage, recovery, accessibility-related operation, and event-record visibility.
These checks give property teams a better basis for choosing access software and elevator hardware than selecting a system only because it advertises elevator access. After the property has defined its requirements, teams can explore ButterflyMX Elevator Controls for resident, staff, and visitor floor-access workflows.
Where ButterflyMX fits in a floor access workflow
ButterflyMX can be part of a controlled elevator access plan that connects elevator controls with residents, staff, visitors, mobile access, credential readers, and video intercoms. Property teams can remotely manage residents, visitors, credentials, and access, while residents can receive visitor calls and grant access from their smartphones. For product context, review how ButterflyMX elevator controls work.
The same planning distinction still matters: credential-triggered or event-triggered access is not the same as a standing recurring floor schedule. Before choosing any implementation, confirm the specific controller compatibility, supported schedule and exception types, event logging, outage behavior, elevator-contractor scope, and emergency design for the property. ButterflyMX may be part of the resident, staff, and visitor access workflow, but the final design still has to fit the elevator system and the building’s requirements.
Frequently asked questions
Can an amenity floor lock after 10 p.m. but stay available during the day?
Yes, that is a typical recurring-rule concept when the access platform and elevator integration support per-floor schedules. The policy would combine a resident group, the amenity floor, a daily access window, and any needed exceptions. Actual availability depends on the platform, controller, and elevator architecture.
Can cleaning staff get elevator access only during work hours?
Yes. Administrators can assign cleaning staff to an access group with approved floors and a recurring work-hours schedule, then use expiration dates or exceptions for temporary assignments. The deployed system should be checked for schedule precedence, credential expiration, logging, and emergency behavior.
What happens to scheduled access during a power or network outage?
Outage and recovery behavior varies by controller and integration, so it must be documented and tested. Do not assume the system will fail open or fail secure. The approved design must account for life-safety rules, local requirements, and how access events are recorded during and after the outage.
Can a one-time exception be added without changing the normal schedule?
Many documented access-control platforms support one-time events, exceptions, or holiday overrides that modify normal access for a defined period. Names, precedence rules, and available exception types vary by platform, so administrators should check current documentation before relying on a specific behavior.
Elevator access control by floor schedule is not just a calendar setting. It is a tested connection between credential rules, floor permissions, elevator architecture, emergency operation, accessibility needs, and day-to-day administration. Define the property policy first, then confirm that the elevator, access-control system, contractor scope, and code review can support it. If you are evaluating controlled elevator access for your property, request a ButterflyMX demo to discuss resident, staff, and visitor access workflows.
Get your free quote!
Fill in the form below, and we'll email you right back.
Want a free quote?
Fill in the form below, and we'll email you right back.
You’ll be redirected shortly...