A lift motor does not raise the car. It raises the difference between the car and a counterweight that very nearly matches it, which is why the machine at the top of a tall building is smaller than most people expect, and why a runaway requires several things to go wrong at once rather than one.

Nora Whitfield works through the safeguards in the order they would have to fail. The ropes are multiple. They are not spooled onto a drum but laid across a grooved sheave and driven by friction, so the failure mode is slipping rather than release. Riding above it is a governor with a rope and pulley of its own, reading speed directly from flyweights that swing outward as the car descends. Past a set margin it cuts the power and lets the machine brake fall. Should the car keep gathering speed, a second stage clamps the governor rope, and a linkage drives wedges into the guide rails until the car is fixed to the building. Releasing it afterwards takes a technician and a manual reset.

Height imposes a separate limit. Steel rope has to carry itself, so above a certain rise most of a rope's capacity goes into holding up rope. Tall towers answer with zoned shafts and transfer lobbies, and the synthetic fibre ropes now appearing exist to push that ceiling higher.

The final chapters treat waiting as the optimisation problem it actually is. Assigning cars to calls means trading time spent waiting against time spent travelling, and one finding stands out: anticipating the passengers who have not pressed a button yet can roughly halve the average wait.

Behind all of it stands a safety code that states its requirements numerically: how much room must be left at the top and bottom of the shaft, at what speed each device must act, how hard the brakes must bite, how often an inspector must look.