Door control unit for elevator system, method for maintaining elevator system and maintenance device for maintaining elevator system

Abstract

A door control unit for an elevator system is described. The door control unit includes a first communication module. The first communication module is configured to communicatively connect the door control unit with a data network of the elevator system. The door control unit can be communicatively connected to a car control unit of the elevator system via a data network of the elevator system. The door control unit includes a second communication module. The second communication module is configured to: be activated in response to a maintenance indicator signal; when activated, operating as an access point of a wireless maintenance network; and when activated, connecting the door control unit with the maintenance device in a wireless communication manner through the wireless maintenance network.

Description

Technical Field

[0001] The present invention relates to a door control unit for an elevator system, a method of maintaining an elevator system, and particularly to a door control unit and maintenance equipment. Aspects of the present invention particularly relate to establishing a communication connection between maintenance equipment of an elevator system and a door control unit for performing maintenance. Aspects of the present invention particularly relate to reliably establishing a secure wireless connection between maintenance equipment and a door control unit in need of maintenance. Background Art

[0002] Elevator systems are known in the art. Some elevator systems may be considered important or even critical infrastructure for transporting passengers and / or goods. Therefore, a high level of safety may be required, and unplanned downtime may be undesirable.

[0003] An elevator system typically includes landing doors. The landing doors may be controlled and / or monitored by a door control unit. A faulty door control unit may cause the elevator system to become inoperable until the fault is resolved by a maintenance technician. Identifying and / or locating the fault and, if necessary, repairing or replacing the faulty door control unit may be labor-intensive and result in extended downtime of the elevator system.

[0004] Accordingly, there is a need to effectively maintain the door control unit of an elevator system. The present disclosure may at least partially address this problem. Summary of the Invention

[0005] The invention is set forth in the appended set of claims.

[0006] According to one aspect, a door control unit for an elevator system is described. The door control unit includes a first communication module. The first communication module is configured to communicatively connect the door control unit to a data network of the elevator system. The door control unit is capable of communicatively connecting to a car control unit of the elevator system via the data network of the elevator system. The door control unit includes a second communication module. The second communication module is configured to: be activated in response to a maintenance indicator signal; when activated, operate as an access point of a wireless maintenance network; and when activated, wirelessly connect the door control unit to maintenance equipment via the wireless maintenance network.

[0007] According to one aspect, a method of maintaining an elevator system is described. The method includes communicatively connecting the door control unit to a data network of the elevator system via a first communication module of the door control unit; communicatively connecting the door control unit to a car control unit of the elevator system via the data network of the elevator system; generating a maintenance indicator signal; evaluating the maintenance indicator signal by the door control unit; and activating a second communication module of the door control unit. The second communication module operates as an access point for a wireless maintenance network. The method further includes communicatively connecting the door control unit to a maintenance device via the second communication module.

[0008] According to one aspect, a maintenance device for maintaining an elevator system is described. The maintenance device includes an interface for communicating with a second communication module of a door control unit according to the aspects and / or embodiments described herein, and an authentication certificate, wherein the authentication certificate is configured to authenticate the maintenance device to the door control unit.

[0009] According to one aspect, a door control unit (DCU) is described. The DCU can be a device for controlling and / or monitoring the landing doors of an elevator system. The DCU can include a control module and / or a controller for controlling and / or monitoring the operation of the landing doors of the elevator system. The DCU can control one or more motors and / or actuators for opening and closing the landing doors. The DCU can control one or more locking mechanisms for controlling the locking and / or unlocking of the landing doors. The DCU can also be communicatively connected to one or more sensors of the landing doors. The sensors can include, but are not limited to: sensors for sensing the position and / or locking state of the door, sensors for sensing the presence of persons or objects inside the landing door (such as a light curtain), or mechanical sensors for sensing the mechanical resistance when closing the door. The DCU can be configured to evaluate the sensor signals. During normal operation of the elevator system, the DCU can be communicatively connected to the controller of the elevator system, such as a car control unit (CCU). The DCU can receive control signals and, in response to the control signals, control the opening and closing of the landing doors associated with the DCU while maintaining a high level of safety. In the event of a failure or error, the DCU can be configured to provide a fault signal to the controller of the elevator system, such as for operating the elevator system in a safe state and / or interrupting the operation of the elevator system. The DCU can be communicatively connected to a landing operation panel (LOP). The LOP can be an interface of the elevator system, such as an input device for receiving inputs from passengers, such as a panel having one or more buttons, keys, touch pads, etc., for receiving elevator calls from passengers. The DCU can be configured to transmit the inputs (such as call signals) to the controller of the elevator system. According to an embodiment, a DCU can be provided for each landing door of the elevator system, for example by mounting to or in the vicinity of the landing door. According to a further embodiment, in an elevator system having multiple landing doors on a single floor, for example, a DCU can be provided for the multiple landing doors.

[0010] According to one aspect, a car control unit (CCU) is described. The CCU can be a control module and / or a controller for controlling and / or monitoring the operation of an elevator car in an elevator system. The CCU can be provided on or in the elevator car, for example by mounting to or in the elevator car. The CCU can be communicatively connected to a car operation panel (COP). The COP can be an interface of the elevator system, such as an input device for receiving inputs from passengers, such as a panel having one or more buttons, keys, touch pads, etc., for receiving destination calls from passengers. The CCU can be configured to transmit the inputs (such as call signals) to the controller of the elevator system. According to one aspect, the CCU can be configured to control and / or monitor one or more functions of the elevator system, particularly functions related to the safety and / or operation of the elevator system and / or the elevator car.

[0011] According to one aspect, a data network of an elevator system is described. The data network can be a packet-based network. The data network can be an Ethernet network. The data network can use an Ethernet-based protocol, such as IEEE 802.3 known at the time of filing this disclosure. The data network can be based on an industrial Ethernet standard, such as but not limited to EtherCAT, Ethernet / IP, PROFINET, POWERLINK, SERCOS III, CC-Link IE, Modbus TCP, or even FIELDBUS. The data network can be a network separate from other networks, such as a wide area network, such as the Internet. The data network can be secure, for example, to prevent access to the data network from devices not related to the elevator system.

[0012] According to one aspect, additionally or alternatively, the data network of the elevator system can be a wireless network. According to one aspect, a wireless maintenance network is described. The wireless maintenance network is a wireless network. The wireless network can include and / or implement a communication connection between at least two devices. Establishing and / or communicating via the wireless network can include transmitting radio signals between at least two devices. The wireless network can be based on a protocol such as wireless LAN (WLAN), for example, a protocol based on the IEEE 802.11 standard known at the time of filing this disclosure. The data network of the elevator system and the wireless maintenance network can utilize the same network protocol, or can utilize different network protocols. Thus, the data network of the elevator system and the wireless maintenance network can be separate or distinct, or even incompatible networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Details will be described below with reference to the drawings, in which:

[0014] Figure 1 A door control unit (DCU) according to an embodiment is schematically shown;

[0015] Figure 2 An elevator system according to an embodiment is schematically shown;

[0016] Figure 3 A method of maintaining an elevator system according to an embodiment is shown; and

[0017] Figure 4 A maintenance device according to an embodiment is schematically shown. DETAILED DESCRIPTION

[0018] Reference will now be made in detail to various embodiments, one or more examples of which are illustrated in each figure. Each example is provided by way of explanation and not limitation. For instance, features shown or described as part of one embodiment can be used in any other embodiment or in combination with any other embodiment to yield yet another embodiment. The present disclosure is intended to embrace such modifications and variations.

[0019] In the following description of the drawings, like reference numerals refer to like or similar components. Generally, only the differences with respect to each embodiment are described. Unless otherwise stated, the description of a part or aspect in one embodiment also applies to the corresponding part or aspect in another embodiment.

[0020] Figure 1 A door control unit (DCU) 100 for an elevator system according to an embodiment is shown. The DCU 100 has a first communication module 104 and a second communication module 102. In Figure 1 the example shown, the first communication module 104 is communicatively connected to a data network 112 and communicatively connected to a car control unit 110 via the data network 112. In Figure 1 the example shown, the second communication module 102 is activated and communicatively connected to a wireless maintenance network 122 and communicatively connected to a maintenance device 120 via the wireless maintenance network 112. It should be noted that the communication connections via the networks 112, 122, particularly the communication connection between the DCU 100 and the maintenance device 120, can be temporary.

[0021] As Figure 1 shown, the DCU 106 can include a controller 106. The controller 106 can be configured to perform tasks associated with the DCU, such as controlling and / or monitoring the operation of one or more landing doors. The controller 106 can include a processor and a memory. The memory can include software. When the software is executed on the processor of the controller 106, the software can cause the controller to perform tasks associated with the DCU 100. When executed by the processor, the software can also cause the controller 106 to perform the methods according to the embodiments described herein.

[0022] According to an embodiment, the controller 106 can be configured to control the operation of the first communication module 104 and / or the second communication module 102. The first communication module 104 and the second communication module 102 can communicatively connect devices connected to the data network 112 and / or the wireless maintenance network 122 to the controller 106.

[0023] According to an embodiment, the first communication module 104 and the second communication module 102 may be configured to connect to or be connected to a network. The network may be controlled, defined, and / or established by the first communication module 104 and / or the second communication module 102. In particular, the first communication module 104 may be configured to connect to the data network 112 as a client. In particular, the second communication module 102 may be configured to establish a wireless maintenance network 122, for example, as an access point. As Figure 1 shown, the first communication module 104 and the second communication module 102 may be communicatively connected to the controller 106. The controller 106 may transmit, send, receive, and / or broadcast data via the first communication module 104 and / or the second communication module 102. The data may be received from or be receivable by a device communicatively connected to the network. Thus, the first communication device 104 and / or the second communication device may enable the controller 106 to communicate with a device connected to the network to which the first communication module 104 and / or the second communication module 102 is connected. In addition, signals and / or data broadcast by the first communication module 104 and / or the second communication module 102 may be received by a device. For example, the maintenance device 120 may receive a signal broadcast by the second communication module 102.

[0024] According to an embodiment, the DCU 100, which includes the controller 106 and optionally even the first communication module 104 and / or the second communication module 106, may be implemented as a computer and / or include a computer, such as a microcomputer, a single-board computer, an embedded device, a system-on-chip device, or any other suitable hardware. Additionally or alternatively, the first communication module 104 and / or the second communication module 102 may be (separate) hardware modules connected to a bus of the controller 106.

[0025] According to an embodiment, for example, as Figure 1 shown, both the first communication module 104 and the second communication module 102 may be wireless network interfaces for communicating with a wireless network, for example, according to the aspects or embodiments described herein. Alternatively, the first communication module 104 may be a wired-based network interface, and the second communication module 102 may be a wireless network interface. The first communication module 104 and the second communication module 102 may be separate modules, for example, implemented as separate network controllers. Alternatively, especially when the data network 112 and the wireless maintenance network 122 are of the same or compatible network type (e.g., a wireless network according to IEEE802.11), the first communication module 104 and the second communication module 102 may be virtual interfaces implemented as a single hardware module, such as a single network controller.

[0026] According to an embodiment, the second communication module 102 may be activatable. In the context of the present disclosure, "activatable" may be understood as being able to switch from a state of no operation or limited operation (e.g., a state where the second communication module does not operate as an access point and / or does not broadcast an SSID) to a state where the second communication module 102 is enabled to operate as an access point of the wireless maintenance network 122 and / or is wirelessly communicatively connected to the maintenance device 120. Thus, the second communication module 102 may be de-activatable. The activation and / or de-activation of the second communication module 102 may be controlled by the controller 106.

[0027] According to an embodiment, the second communication module 102 is configured to operate as an access point of the wireless maintenance network 122 when activated. Operating the second communication module 102 as an access point may include: operating the second communication module 102 as an access point according to a standard such as IEEE 802.11, thereby allowing a device such as the maintenance device 120 to be communicatively connected to the DCU 100, and / or broadcasting a service set identifier (SSID).

[0028] According to an embodiment, the DCU 100 is configured to activate the second communication module 102 in response to a maintenance indicator signal. The maintenance indicator signal may be any type of signal indicating that the DCU 100 should enter a maintenance mode. The maintenance indicator signal may be generated externally to the DCU 100 and transmitted to the DCU 100, or the maintenance indicator signal may be generated internally by the DCU 100. The maintenance indicator signal may be obtainable or used and / or evaluable by the DCU 100 (e.g., by the controller 106). The maintenance indicator signal may be an external signal that can be received by the DCU 100. For example, the maintenance indicator signal may be generated in response to an input by a maintenance technician at an interface of the elevator system (e.g., at the LOP, COP, or maintenance interface) in order to obtain access to the maintenance function of the DCU 100. For example, the maintenance technician may press one or more buttons or keys, enter a code, provide a key or keystroke, provide a signal (e.g., a radio signal), or otherwise access or access a terminal or panel of the elevator system and provide an input at the terminal or panel of the elevator system. The interface may generate a maintenance indicator signal in response to the input and transmit the maintenance indicator signal to the DCU 100 via, for example, the data network 112. The DCU 100 may evaluate the maintenance indicator signal and activate the second communication module 102 in response to the maintenance indicator signal.

[0029] Additionally or alternatively, according to an embodiment, a maintenance indicator signal may be generated by a device of the elevator system, such as in response to a fault of the device, and transmitted to the DCU 100 via, for example, the data network 112.

[0030] According to an embodiment, the DCU 100 may be configured to generate a maintenance indicator signal, in particular in response to a fault and / or indication of a fault. The fault may be an internal fault of the DCU 100. An internal fault of the DCU 100 may be understood as a fault directly related to the DCU 100 and may include faults of systems, modules, and / or sensors connected to the DCU 100. Thus, it should be noted that even a properly operating DCU 100 may experience an internal fault, for example, if the DCU 100 cannot operate and / or perform tasks as expected. Internal faults may include, but are not limited to: a fault of the DCU 100; a fault of a system, module, and / or sensor connected to the DCU 100; and / or a fault that prevents the DCU from controlling and / or monitoring elevator system components controlled and / or monitored by the DCU 100 as expected. For example, the DCU 100 may be configured to detect whether there is a fault in a landing door sensor and / or a landing door actuator controlled by the DCU 100. For example, an internal fault of the DCU 100 may include data corruption in the memory of the DCU, such as the memory of the controller 106. An internal fault of the DCU 100 may include a faulty configuration of the DCU 100. An internal fault of the DCU 100 may include an error logged in a log file stored in the memory of the DCU 100. An internal fault of the DCU may include a hardware fault of the DCU 100.

[0031] According to an embodiment, the fault may include a loss of a communication connection between the DCU 100 and a component of the elevator system, such as a loss of a communication connection with the data network 112 of the elevator system, a loss of a communication connection with the CCU 110, and / or a loss of a communication connection with the LOP. According to an embodiment, the DCU 100 may be configured to detect a loss of a communication connection by continuously evaluating heartbeat signals sent from one or more components of the elevator system, such as via the data network 112. The DCU 100 may be configured to detect a fault indicating a communication loss by detecting that no heartbeat signal and / or an unexpected heartbeat signal has been received by the DCU within a predefined time interval. For example, the predefined time interval may be a time interval of 1 second or more, 2 seconds or more, 5 seconds or more, or 10 seconds or more.

[0032] According to an embodiment, the DCU 100 can be configured to deactivate the second communication module 102 in the absence of a maintenance indicator signal and to activate the second communication module 102 in response to a maintenance indicator signal. Additionally or alternatively, in response to a maintenance indicator signal, the DCU 100 can be configured to keep the second communication module 102 activated, for example, activated indefinitely or activated for a predetermined duration and / or activated until the activation is reset (e.g., by a maintenance technician). This can advantageously allow a maintenance technician to identify and / or access the DCU 100 that is experiencing intermittent or temporary failures, even if the failure does not currently exist.

[0033] According to an embodiment, the DCU 100 can be configured to activate the second communication module 102 as an access point using a service set identifier (SSID). The SSID can be broadcast by the second communication module 102, for example, for reception and display by the maintenance device 120. The SSID can include information for allowing a maintenance technician to identify the DCU 100. For example, the SSID can include a symbol or even a string indicating that the access point is the access point of the DCU 100. For example, the SSID can include a type indicator indicating the type, model, generation, and / or version of the DCU 100. Additionally, additionally or alternatively, the SSID can include additional information, such as information indicating the location of the DCU 100 (such as the floor and / or landing of the DCU 100) or an indicator (such as a number) assigned to the DCU 100.

[0034] According to an embodiment, especially in an embodiment where the second communication module 102 does not operate as an access point in a deactivated state, operating the access point with the SSID and broadcasting the SSID can be understood as the SSID broadcast being a fault indicator. In other words, since the DCU 100 operates the second communication module 102 in response to a maintenance indicator signal, broadcasting the SSID by the DCU 100, especially in the case where a maintenance indicator signal has not been generated through an input at the interface of the elevator system before, may indicate a fault.

[0035] According to an embodiment, additionally or alternatively, the SSID can include a fault description as a fault indicator. For example, the SSID can include: a symbol and / or even a string representing a fault or error code, a descriptor of the reason for the maintenance indicator signal, and / or other types of status information.

[0036] Advantageously, the SSID of the DCU 100 can be broadcast and received by the maintenance device 120. The maintenance device 120 can display the SSID, for example but not limited to, which can read a string such as "error_sensor1_DCU_level2". Advantageously, maintenance technicians who have read the SSID can be notified of, for example, the type of error, the faulty component, and / or the location of the faulty DCU.

[0037] According to an embodiment, the DCU 100 can be configured to allow a user of the maintenance device 120 to access or use the service functions of the DCU 100 after establishing a wireless communication connection between the DCU 100 and the maintenance device 120. For example, the DCU 100 can present status information, maintenance functions, allow the installation of updated firmware, and / or provide other known service functions known in the art. For example but not limited to, the DCU 100 (especially the controller 106) can be configured to execute web server software (such as an HTTP server), and the user of the maintenance device 120 can access or use the web page that provides service functions on the maintenance device 120 after being communicatively connected to the DCU 100 through the wireless maintenance network 122. Similarly, the DCU can be configured to provide maintenance functions to dedicated maintenance software (such as a program or an application) running on the maintenance device.

[0038] According to an embodiment, the DCU 100 is configured to authenticate the maintenance device 120, especially before connecting to the wireless maintenance network 122. The authentication can optionally include requiring the user of the maintenance device 120 to enter a password and / or user credentials, for example, passwords and / or user credentials known in the art for Wi-Fi Protected Access (WPA), WPA2, WPA3, or WPA2-PSK.

[0039] According to an embodiment, as an addition to or an alternative to requiring a password, authenticating the maintenance device 120 includes certificate-based authentication of the maintenance device 120. The DCU 100 can include an authentication server. The DCU 100 (especially the controller 106) can be configured to execute authentication server software. The authentication server can be configured to verify the authentication certificate of the maintenance device. The authentication server can also be configured to verify the authorization of the maintenance device 120.

[0040] The authentication server can be configured to authenticate the maintenance device according to known certificate-based authentication methods known in the art. Thus, the authentication server can be a server known in the art. By way of example and not limitation, the authentication server can be a server using RADIUS-based authentication, as known as of the filing date of the present application. It should be noted that in the context of the present disclosure, the authentication server should be understood as software suitable for verifying the certificate of the maintenance device 120. Some RADIUS-based solutions can employ architectures in which the DCU can be operated as a RADIUS client. Thus, the DCU 100 can be configured as a RADIUS client and / or a RADIUS server. Known suitable RADIUS solutions include, but are not limited to, FreeRADIUS and hostapd.

[0041] The DCU 100 may have stored a server certificate, for example, in the memory of the controller 106. The server certificate can be signed by a root certificate, such as a certificate issued by a root certificate authority or a certificate derived from a certificate signed by a root certificate authority in a trust chain, for example. The root certificate authority can be, for example, the manufacturer of the DCU 100 and / or the manufacturer, installer, and / or owner of the elevator system. The DCU 100 can be configured to receive a server certificate (e.g., an updated server certificate) via a public key infrastructure (PKI).

[0042] The maintenance device 120 may have stored an authentication certificate, for example, in the memory of the maintenance device 120. The authentication certificate can be derived from a certificate (e.g., a server certificate or a root certificate) derived from a root certificate, for example, signed therewith. Thus, the DCU 100 can be configured to authenticate the maintenance device 120 based on the server certificate and the authentication certificate when connected to the wireless maintenance network 122.

[0043] According to an embodiment, the DCU 100 can be configured to authorize the maintenance device 120. In the context of the present disclosure, "authorization" can be understood as any utilization of user and / or device policies. In a first example, the maintenance device 120 can be fully authorized as a result of being authenticated. In a second example, the DCU 100 can be configured to apply specific policies. The DCU 100 can, for example, have stored in the memory of the controller 106 a list or other type of data structure of users, groups, and / or device credentials and policies associated with the credentials. For example, the list can define a policy for selectively assigning pre-defined permissions to the maintenance device 120. For example, a first maintenance device 120 can have read-only permissions, such as for viewing the status information of the DCU 100, while a second maintenance device 120 can have read-write permissions, such as for changing the configuration of the DCU 100.

[0044] According to an embodiment, the list of server certificates and / or credentials can be modifiable, for example, by communicatively connecting the DCU 100 to an external device (e.g., a server configured to update the DCU 100). For example, according to an embodiment, the DCU 100 can be configured to connect to an external device via a data network 112 and an edge device and receive updates from the external device, the edge device providing a communication connection between the data network 112 and a wide area network (e.g., the Internet). The updates can include one or more server certificates and / or policies to be installed and / or replaced on the DCU 100 (e.g., in the memory of the controller 106).

[0045] Now referring to Figure 2 , an elevator system 200 according to an embodiment is described. The elevator system 200 includes an elevator car movably disposed within an elevator hoistway. The elevator system 200 can be an elevator system for transporting passengers.

[0046] As Figure 2 shown, the elevator car includes a CCU 110. The CCU 110 can be communicatively connected to a CCP (not shown) disposed within the elevator car. The CCU 110 can include a controller. The controller can include a processor and a memory. The memory can include software. When the software is executed by the processor of the controller, the software can cause the controller to perform tasks associated with the CCU 110. When the software is executed by the processor, the software can also cause the controller to perform the methods according to the embodiments described herein. The CCU 110 can include a communication module for communicatively connecting the CCU to the data network 112.

[0047] The elevator system 200 includes three landings, and each landing is provided with a landing door. The landing doors are operated and / or monitored by DCUs 1001, 1002, 1003. Each of the DCUs 1001, 1002, 1003 (collectively referred to as DCU 100) can be a DCU 100 as described herein with reference to Figure 1 The DCU 100 described. In Figure 2 the exemplary embodiment shown, DCU 1001 is communicatively connected to CCU 110 via data network 112, and is also communicatively connected to maintenance device 120 via wireless maintenance network 122. Thus, in the example shown, the second communication module 102 of DCU 1001 is activated.

[0048] According to an embodiment, more than one or even all of the DCUs 100 can be communicatively connected to data network 112, and / or communicatively connected to CCU 110 via data network 112. For example, each DCU 100 can be communicatively connected to a wireless access point of data network 112. CCU 110 can include an access point of data network 112. Additionally, according to an embodiment, DCU 100 can be configured to operate in a mesh network, for example, as a client within the mesh network. The mesh network can be data network 112, or can be communicatively connected to data network 112. Advantageously, this can allow DCU 100 to maintain a communicative connection to CCU 110, even though it is outside the range of direct communication with CCU 100.

[0049] Figure 2 A maintenance technician is shown holding maintenance device 120. The maintenance device is communicatively connected to DCU 1001. The maintenance technician can access or utilize the maintenance functions of DCU 1001 through maintenance device 120.

[0050] As Figure 2 shown, in the given example, in the given example of DCU 100, only DCU 1001 is operating as an access point for wireless maintenance network 122. According to an embodiment, more than one or even all of the DCUs 100 can operate as access points for a wireless maintenance network (e.g., wireless maintenance network 122). Each DCU 100 can provide an independent wireless maintenance network. Thus, each DCU 100, when activated, can broadcast a unique SSID.

[0051] According to an embodiment, more than one DCU 100 or even all of the DCUs 100 can operate as access points for a wireless maintenance network simultaneously. As referenced in Figure 1As discussed, the DCU 100 is configured to activate the second communication module 102 in response to a maintenance indicator signal. Thus, an independent maintenance indicator signal can be provided to or generated by the DCU 100. Additionally or alternatively, a maintenance indicator signal generated by an input at the interface of the elevator system can activate one DCU 100, several selected DCUs 100, or even all DCUs 100 of the elevator system 200. For example, an input provided by a maintenance technician at the LOP or COP can cause all DCUs to operate as access points of a wireless maintenance network. This can advantageously allow the maintenance technician to quickly perform tasks such as connecting to each DCU 100 to perform maintenance.

[0052] According to an embodiment, the second communication module 102 of the DCU 100 can be deactivated during normal operation, i.e., not operate as an access point of a wireless maintenance network. This can advantageously reduce RF congestion.

[0053] According to an embodiment, the DCU 100 can generate a maintenance indicator signal, for example, following an input from a maintenance technician, or even during normal operation, each DCU can operate as an access point simultaneously. However, in some cases, this may result in several SSIDs being broadcast and may even cause RF congestion. Therefore, it may be difficult to select the desired wireless maintenance network, such as the wireless maintenance network of a faulty DCU 100. Thus, a priority indicator signal can be generated, for example, by a DCU experiencing a fault, by a CCU 110 in response to an input, or by any other component of the elevator system 200. The priority indicator signal can be targeted at the selected DCU 100 or even broadcast. The priority indicator signal can be communicated, for example, via the data network 112. In response to the priority indicator signal, the DCU 100 receiving the priority indicator signal can be configured to deactivate the second communication module 102. This can advantageously simplify the selection of the desired DCU 100, such as a DCU that has lost connection to the data network 112.

[0054] Now referring to Figure 3 , a method 300 for maintaining an elevator system is described. The elevator system can be the elevator system 200 described with reference to Figure 2 . The method 300 can be a method for maintaining the DCUs of the elevator system, such as the DCU100 described with reference to Figure 1 and / or Figure 2 . According to an embodiment, the DCU 100 (specifically the controller 106) can be configured to perform the operations of the method 300 attributed to the DCU. Similarly, referring to Figure 4The described maintenance device 120 (in particular the controller 410) can be configured to perform the operations of method 300 attributed to the maintenance device 120.

[0055] Method 300 includes communicatively connecting 310 the DCU to the data network of the elevator system via a first communication module of the door control unit. Method 300 can include, for example, maintaining the communication connection to the data network during normal operation of the elevator system.

[0056] Method 300 includes communicatively connecting 320 the DCU to the CCU of the elevator system via the data network of the elevator system. Thus, method 300 can include communicatively connecting the CCU to the data network. Method 300 can include, for example, maintaining the communication connection between the DCU and the CCU during normal operation of the elevator system. The method can include sending a heartbeat signal between the DCU and the CCU, for example, regularly sending a heartbeat signal from the CCU to the DCU.

[0057] Method 300 includes generating 330 a maintenance indicator signal. The maintenance indicator signal can be generated as referred to in Figure 1 or Figure 2 described. For example, the maintenance indicator signal can be generated following an external input, and / or the maintenance indicator signal can be generated in response to a fault. The fault can be, for example, an internal fault of the DCU, and / or a loss of the communication connection of the DCU to the data network, the CCU, and / or the LOP. Thus, since the loss of the communication connection between the DCU and the data network and / or the CCU can indicate a fault, it is not essential to maintain the communication connection to the data network and / or the CCU for performing method 300.

[0058] Method 300 includes evaluating 340 the maintenance indicator signal. The maintenance indicator signal can be evaluated by the DCU. Evaluating 340 the maintenance indicator signal can include: determining the source of the maintenance indicator signal. Evaluating the maintenance indicator signal can include: determining whether there is a maintenance indicator signal. In addition, evaluating the maintenance indicator signal can include: further processing and / or evaluating the maintenance indicator signal. For example, the maintenance indicator signal can be provided with, include, and / or indicate a fault description, and information can be derived from the fault description. For example, the maintenance indicator signal can be provided from an external signal source, and information about the maintenance indicator signal can be derived from the maintenance indicator signal source. For example, the DCU can derive that a maintenance indicator signal received from the LOP or COP following the input of a maintenance technician indicates a planned maintenance. For example, a communication loss may result in a fault indicator indicating the communication loss. Other fault indicators can include hardware faults, configuration faults, power outages, intrusion detections, etc. The fault description can be included as a fault indicator in the SSID broadcast by the DCU.

[0059] Method 300 includes activating 350 a second communication module of the DCU. The second communication module may be activated in response to evaluating and / or having evaluated a maintenance indicator signal. The second communication module operates as an access point of a wireless maintenance network. The wireless maintenance network may be a wireless network according to IEEE 802.11, such as IEEE 802.11b / g / a / n / ac / ax / ad, but alternative protocols may also be used. Operating the second communication module as an access point may include: broadcasting the SSID of the wireless maintenance network. The SSID may be received by a device such as a maintenance device. A list of available wireless networks may be presented to a user of the maintenance device, and the list of available wireless networks may include the SSID of the wireless maintenance network.

[0060] Method 300 includes communicatively connecting 360 the DCU with a maintenance device via the second communication module. Communicatively connecting the DCU with the maintenance device may include: connecting the maintenance device to the wireless maintenance network established by the DCU. Additionally, communicatively connecting the DCU with the maintenance device may include: establishing a two-way data connection, particularly establishing a communication where the maintenance device can send data to and receive data from the DCU.

[0061] According to an embodiment, particularly after activating 350 the second communication module, method 300 may include authenticating the maintenance device. In some embodiments, authenticating the maintenance device may include: connecting the maintenance device to the wireless maintenance network, and / or registering the maintenance device to the wireless maintenance network. Authenticating the maintenance device may optionally include: password-based and / or credential-based authentication. Authenticating the maintenance device may particularly include: verifying the authentication certificate of the maintenance device.

[0062] According to an embodiment, particularly during or after authenticating the maintenance device, method 300 may include determining authorization for the maintenance device. Determining authorization may include: determining permissions, policies, access or access rights associated with the maintenance device and / or other information associated with granting rights. Determining authorization for the maintenance device may include: selecting a subset of functions available to the maintenance device and / or a user of the maintenance device based on the authorization. Thus, a fully authorized maintenance device may access or have access to some or even all of the maintenance functions, while an unauthorized or only partially authorized maintenance device may have limited access.

[0063] According to an embodiment, method 300 may include: after communicatively connecting the DCU with the maintenance device, and particularly after authenticating and / or authorizing the maintenance device by the DCU, accessing the maintenance functions of the DCU using the maintenance device. In particular, a maintenance technician may utilize the maintenance device as an interface for accessing the maintenance functions.

[0064] According to an embodiment, method 300 may be performed on one or more DCUs within an elevator system. The method may include providing and / or installing one or more DCUs for the elevator system, the one or more DCUs being configured to perform functions according to the embodiments described herein.

[0065] According to an embodiment, the mobile device may be a temporary device, such as a device provided by a maintenance technician when servicing the elevator system. Thus, method 300 may include providing the maintenance device and / or bringing the maintenance device in the vicinity of the DCU, such as until the maintenance device and the DCU are within the radio signal range of communication within a wireless maintenance network.

[0066] According to an embodiment, the maintenance device may be defined by authentication and / or authorization by the elevator system, particularly the DCU. Thus, method 300 may include installing an authentication certificate for authenticating the maintenance device to the DCU onto the maintenance device. Installing the authentication certificate may optionally include further configuring the maintenance device to communicatively connect to the DCU for maintenance and / or perform maintenance, such as installing additional software, such as maintenance software, programs, and / or applications.

[0067] According to an embodiment, installing the authentication certificate on the maintenance device may include, for example, accessing the DCU through an authenticatable device and causing the DCU to generate the authentication certificate and / or copy the authentication certificate to a previously unauthenticated device. For example, a first maintenance technician may use an authenticatable first maintenance device to connect to the DCU according to the embodiments described herein and initiate a handover function on the DCU. The handover function may include transferring the authentication certificate to a previously unauthenticated second maintenance device. After receiving the authentication certificate, the second maintenance device may be authenticatable and may connect to the DCU according to the embodiments described herein.

[0068] According to an embodiment, the authorization certificate or authentication certificate may be revocable. For example, the authorization certificate may be set to expire on a pre-defined date. For example, the DCU may be configured to revoke a selected authentication certificate (e.g., automatically or in response to an input). Additionally, the DCU may be configured to dynamically adjust the policy for a selected maintenance device and / or the authentication certificate associated with the maintenance device, such as access or access privileges. This may advantageously allow a selected maintenance device to be excluded from accessing or accessing the DCU without the need to exclude access to the maintenance device, such as in the case of a potential security breach, such as due to the loss of the maintenance device or the expiration of a maintenance contract.

[0069] According to an embodiment, method 300 may include a maintenance device verifying that the DCU is a trusted DCU. This may include verifying whether the authentication certificate installed on the maintenance device is within the same trust chain as the server certificate stored on the DCU. This may advantageously prevent the maintenance device from connecting to an untrusted DCU and / or a system simulating a DCU, which may improve security.

[0070] Reference is now made to Figure 4 , a maintenance device 120 for maintaining an elevator system according to an embodiment is described. The maintenance device 120 includes a controller 410, a memory 420, an interface 430, and a display 440. The maintenance device 120 may be a portable device. For example but not limited to, the maintenance device 120 may be a smart phone, a portable computer (such as a laptop), a tablet computer, and / or a wearable device (such as a smart watch).

[0071] The interface 430 may be a communication module configured to communicate with the second communication 102 described with reference to Figure 1 . For example, the interface 430 may be a Wi-Fi adapter, such as the Wi-Fi adapter of a smart phone.

[0072] The controller 410 may include a processor. According to the embodiments described herein, the processor may be configured to execute software (e.g., one or more software programs) to cause the mobile device to connect to the second communication module of the DCU 100. The software program may be stored in the memory 420. The memory 420 is communicatively connected to the controller 410 and may be accessed or retrieved by the controller. The memory 420 includes an authentication certificate, specifically, an authentication certificate is stored on the memory 420. According to the embodiments described herein, the authentication certificate may be configured to authenticate the maintenance device to the DCU. Specifically, the controller 410 may access or retrieve the certificate and process information (e.g., information exchanged during a handshake or handover) based on the certificate to authenticate the mobile device to the DCU.

[0073] The mobile device includes a display 440. In the Figure 4 example shown, the controller 410 controls the display 440 to display a list of available wireless networks. In this example, the SSIDs of the networks, SSID 1, SSID 2, and SSID 3 are shown. A maintenance technician operating the maintenance device 120 may select one of the displayed SSIDs, for example, based on the information included in the SSID.

[0074] In an exemplary scenario, SSID 1 could read "Home WiFi", SSID 2 could read "Office Printer", and SSID 3 could read "error_sensor1_DCU_level 2". Thus, a maintenance technician could easily determine, based on the displayed SSID, that only SSID 3 is related to the maintenance of the elevator system. Additionally, the maintenance technician could determine that the level 2 DCU has activated the second communication module due to a maintenance indicator signal caused by a fault in the component "sensor 1". The repair technician can now easily determine the location of the DCU experiencing the fault. Additionally, the repair technician can connect to the wireless maintenance network and perform maintenance on the elevator system (specifically the DCU) without physically accessing or visiting the DCU.

[0075] Advantageously, the embodiments described herein can simplify the maintenance of an elevator system by allowing a maintenance technician to easily identify and locate faults. Additionally, a certificate-based authentication system according to an embodiment can provide a higher level of security than a purely password-based system. The certificate can be revocable, which can allow for the secure management of authenticable maintenance devices. According to the embodiments described herein, accessing or visiting the DCU using a maintenance device can allow for the maintenance or repair of the DCU without the need to physically access or visit or even replace the DCU.

[0076] While the foregoing is directed to some embodiments, other and further embodiments can be devised without departing from the basic scope, and the scope is determined by the appended claims.

Claims

1. A door control unit (100) for an elevator system (200), comprising: A first communication module (104), wherein the first communication module (104) is configured to communicatively connect the door control unit (100) to a data network (112) of the elevator system (200), and wherein the door control unit (100) is communicatively connectable to a car control unit (110) of the elevator system (200) via the data network (112) of the elevator system (200); A second communication module (102), wherein the second communication module (102) is configured to: - Be activated in response to a maintenance indicator signal; - When activated, operate as an access point for a wireless maintenance network (122); and - When activated, wirelessly connect the door control unit (100) to a maintenance device (120) via the wireless maintenance network (122).

2. The door control unit (100) according to claim 1, wherein, The data network (122) of the elevator system (200) is a wireless network.

3. The door control unit (100) according to claim 1 or 2, wherein, The access point has a service set identifier (SSID), and the service set identifier includes a fault indicator.

4. The door control unit (100) according to any one of the preceding claims, wherein, The wireless maintenance network (122) is a network separate from the data network (112) of the elevator system (200).

5. The door control unit (100) according to any one of the preceding claims, wherein, The door control unit (100) is configured to authenticate the maintenance device (120).

6. The door control unit (100) according to claim 5, wherein, The door control unit includes an authentication server (106), and wherein, The authentication server (106) is configured to verify the authentication certificate of the maintenance device (120) and the authorization for the maintenance device (120).

7. An elevator system (200), comprising: At least one door control unit (100) according to any one of claims 1 to 6 and a car control unit (110).

8. A method (300) for maintaining an elevator system, comprising: Communicatively connecting the door control unit to a data network of the elevator system via a first communication module of the door control unit (310); Communicatively connecting the door control unit to a car control unit of the elevator system via the data network of the elevator system (320); Generating (330) a maintenance indicator signal; Evaluating (340) the maintenance indicator signal by the door control unit; Activating (350) a second communication module of the door control unit, wherein the second communication module operates as an access point for a wireless maintenance network; Communicatively connecting the door control unit to a maintenance device via the second communication module (360).

9. The method (300) according to claim 8, wherein, Activating (350) the second communication module includes: transmitting a service set identifier SSID, and wherein, The SSID includes a fault indicator.

10. The method (300) according to claim 8 or 9, wherein, Communicatively connecting the door control unit to the maintenance device (360) includes: authenticating the maintenance device.

11. The method (300) according to claim 10, wherein, Authenticating the maintenance device includes: The authentication certificate of the maintenance device is verified by the door control unit, and authorization for the maintenance device is determined by the door control unit.

12. The method (300) according to any one of claims 8 to 11, wherein, The maintenance indicator signal is generated in response to a fault, and wherein the fault is at least one selected from the group consisting of: - An internal fault of the door control unit; - Loss of communication connection of the door control unit to the data network of the elevator system; - Loss of communication connection of the door control unit to the car control unit; - Loss of communication connection of the door control unit to the landing operation panel.

13. The method (300) according to any one of claims 8 to 12, wherein The maintenance indicator signal is generated by an input at the interface of the elevator system.

14. The method (300) according to any one of claims 8 to 13, comprising: An authentication certificate for authenticating the maintenance device to the door control unit is installed on the maintenance device.

15. A maintenance device (120) for maintaining an elevator system (200), comprising: An interface (430) for communicating with a second communication module (102) of a door control unit (100) according to any one of claims 1 to 7; and An authentication certificate, wherein the authentication certificate is configured to authenticate the maintenance device (120) to the door control unit (100).

Images