An emergency control method and device of a linkage door lock and a storage medium

Abstract

An emergency control method and device of a linkage door lock and a storage medium, relating to the technical field of door lock control, the method comprising: in response to obtaining a failure event of an elevator, obtaining running state data of the elevator and personnel detection data in the car; determining an effective trapping event accordingly; in response to the effective trapping event, extracting the failure attribute of the failure event and the physical location characteristics of the elevator; generating a pass certificate provided with a validity period and having a space-time constraint attribute and saving the pass certificate, and sending the pass certificate to a designated maintenance person; receiving a verification request, the verification request carrying to-be-verified information, the to-be-verified information including a to-be-verified pass certificate; in response to the to-be-verified information passing verification, controlling an access control node to open; wherein the passing verification includes that the to-be-verified pass certificate is consistent with the saved pass certificate, and the request time is within the validity period. The embodiments of the present disclosure can ensure that the maintenance personnel arrive at the failure elevator in time for disposal under the premise of safety.

Description

Technical Field

[0001] This article relates to an access control technology, and more particularly to an emergency control method, device and storage medium for a linked door lock. Background Technology

[0002] Elevators may experience various malfunctions during operation, such as people being trapped in the elevator, door system failures, or abnormal operation. All of these require maintenance personnel to arrive at the scene in a timely manner for repair or rescue.

[0003] In real-world scenarios, access routes to malfunctioning elevators are often equipped with access control systems, such as building entrances, unit doors, or floor corridor doors. In related technologies, maintenance personnel typically need to contact property management personnel or residents to remotely open the door after arriving at the access control point.

[0004] However, property management personnel or owners may not be able to respond in a timely manner, resulting in maintenance personnel "arriving but unable to enter," delaying the time for troubleshooting. Summary of the Invention

[0005] This disclosure provides an emergency control method, device, and storage medium for a linked door lock, which enables maintenance personnel to reach the malfunctioning elevator while ensuring safety.

[0006] The first aspect of this disclosure provides an emergency control method for a linked door lock, the method comprising: In response to the detection of an elevator malfunction event, the system acquires the elevator's operating status data and the personnel detection data inside the car. When the elevator is determined to be stopped in a non-leveling area based on the operating status data, and when it is confirmed that there are people in the car based on the personnel detection data, it is determined to be a valid entrapment event. In response to the valid entrapment event, the fault attributes of the fault event and the physical location features of the elevator are extracted, and the access control node leading to the faulty elevator is determined based on the physical location features; Based on the fault attributes, a pass with an expiration date and spatiotemporal constraints is dynamically generated and saved. The pass is then sent to the terminal device of the designated maintenance personnel. The pass is used to open the access control node leading to the faulty elevator. Receive a verification request for opening the access control node, the verification request carrying information to be verified, the information to be verified including the access credential to be verified; In response to the verification of the information to be verified, the access control node is opened; wherein, the verification of the information to be verified includes: the access credential to be verified is consistent with the stored access credential, and the request time is within the validity period.

[0007] In one exemplary instance, the access control node leading to the faulty elevator is determined in the following manner: Obtain the physical location information of the faulty elevator and the departure location information of the designated maintenance personnel; Based on the obtained physical location information of the faulty elevator, the departure location information of the designated maintenance personnel, and the pre-obtained access control location information, and using the building's indoor map, and by simulating the physical passage path of the designated maintenance personnel from their departure location to the faulty elevator, multiple access control nodes connected in series on the physical passage path are extracted and used as access control nodes leading to the faulty elevator.

[0008] In one exemplary instance, the step of dynamically generating a pass with an expiration date and spatiotemporal constraints based on the fault attributes includes: Obtain fault characteristic data when the faulty elevator malfunctions; wherein the types of fault characteristic data include at least one of current, voltage, power, vibration, speed, acceleration, temperature, rotational speed, and door status; The fault characteristic data is used as an encryption seed, combined with a timestamp, to generate a unique rescue work order number. A one-time password uniquely bound to the rescue work order number is generated using a time-based one-time password algorithm or a hash-based message authentication code algorithm, and an expiration period is set. The one-time password with an expiration period is used as the access credential.

[0009] In one exemplary instance, the verification of the information to be verified further includes: the identity information to be verified is consistent with the pre-stored identity information of the designated maintenance personnel.

[0010] In one exemplary instance, the identity information includes: NFC identification information of the maintenance personnel's employee ID card; The method further includes: When the number of incorrect entries for the access pass reaches a preset limit, or when the NFC identification information of the maintenance personnel's employee ID card does not match the pre-stored NFC identification information of the maintenance personnel's employee ID card, the access control node is locked for a preset duration.

[0011] In one exemplary instance, the method further includes: The credential generation key is pre-distributed to the access control node and stored locally. The access control node is pre-configured with an offline credential generation algorithm and fault characteristic benchmark data synchronized with the cloud. When it is determined that a certain access control node leading to the faulty elevator is in an offline state with communication interruption, based on the credential generation key and the fault feature benchmark data, an access credential with an expiration date and spatiotemporal constraints is generated by the offline credential generation algorithm and used to open the access control node in the offline state. This credential is then saved and sent to the terminal device of the designated maintenance personnel. When the terminal device presents the offline access pass to the offline access control node, it generates a local comparison pass in real time based on the locally stored pass generation key and fault feature benchmark data, and performs a consistency comparison with the offline access pass. When the comparison is successful, it controls the offline access control node to open.

[0012] In one exemplary instance, the access control node leading to the faulty elevator includes: a plurality of first access control nodes that the designated maintenance personnel must pass through sequentially on the physical access path; the access credential includes: a sub-access credential corresponding to each of the first access control nodes; The step of sending the access pass to the terminal device of the designated maintenance personnel includes: Based on the physical access path from the starting position to the faulty elevator, the multiple first access control nodes are sorted according to the order of passage, and the sub-access pass corresponding to the first first access control node is sent to the terminal device of the designated maintenance personnel. Only after receiving a callback signal indicating that the sub-access pass corresponding to the current first access control node has been verified will the sub-access pass corresponding to the next first access control node in the sequence be sent to the terminal device of the designated maintenance personnel.

[0013] In one exemplary instance, the validity period of the access pass is set by setting a dynamic validity period independently for each sub-access pass corresponding to each first access control node on the physical access path; The dynamic validity period of the sub-access pass corresponding to each first access control node is set in the following way: For the first access control node on the physical access path, the distance between the designated maintenance personnel and the first access control node is determined based on their departure location information and the location information of the first access control node, and is set based on the distance between them and the expected departure time. For each of the first access control nodes on the physical access path other than the first access control node, the physical walking distance between the two nodes is determined based on the location information of the current access control node and the location information of the previous access control node. The distance between the two nodes is dynamically calculated and set based on the physical walking distance and the expected walking speed.

[0014] In one exemplary instance, the fault event includes: a first fault event requiring multiple maintenance personnel to work together to repair it; when the detected fault event is the first fault event, the designated maintenance personnel are multiple; The step of sending the access pass to the terminal device of the designated maintenance personnel includes: Send the corresponding access pass to the terminal device of each designated maintenance personnel. The access pass for each designated maintenance personnel includes: sub-access passes corresponding to multiple first access control nodes that the designated maintenance personnel need to pass through sequentially on their physical access path; the physical access path of the designated maintenance personnel is obtained by simulating the process of the designated maintenance personnel starting from the starting position and arriving at the faulty elevator. The verification of the pending information at the first access control node at the end of the core machine room where the faulty elevator is located is completed, including receiving a callback signal indicating that the pending information sent by all designated maintenance personnel through their respective terminal devices has been verified.

[0015] In one exemplary instance, after sending the access credential to the terminal device of the designated maintenance personnel, the method further includes: Receive a renewal request sent from the terminal device of the designated maintenance personnel; If the renewal request is initiated within the set validity period, the validity period of the pass is extended; In response to the situation where the renewal request is initiated after the set validity period, a new access pass is generated, a validity period is set for the new access pass, and the new access pass is sent to the terminal device of the designated maintenance personnel.

[0016] An embodiment of the second aspect of this disclosure provides an emergency control device for a linked door lock, comprising: a memory and a processor, the memory being configured to store an executable program; The processor is configured to read and execute the executable program to perform the emergency control method for the interlocking door lock described in any of the preceding claims.

[0017] An embodiment of the third aspect of this disclosure provides a storage medium storing a computer program, wherein when the computer program is executed by a processor, it can implement the emergency control device for the linkage door lock as described in any of the preceding claims.

[0018] Compared with related technologies, the emergency control method, device and storage medium for the linkage door lock provided in this disclosure generates an access pass with an expiration date after detecting an elevator malfunction and sends it to the terminal device of the designated maintenance personnel. This allows maintenance personnel to pass through the access control to the malfunctioning elevator without relying on manual coordination from property management personnel or owners. At the same time, by setting an expiration date and assigning a time and space constraint attribute to the access pass, the validity period and scope of use of the access pass are limited, avoiding the risk of abuse of the access pass. Under the premise of ensuring safety, maintenance personnel can reach the malfunctioning elevator in a timely manner to handle the situation.

[0019] Other features and advantages of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the application. Other advantages of this application can be realized and obtained by means of the embodiments described in the description and the accompanying drawings. Attached Figure Description

[0020] The accompanying drawings are used to provide an understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0021] Figure 1 This is a flowchart illustrating an emergency control method for a linked door lock according to an embodiment of the present disclosure; Figure 2 This is a schematic diagram of the structure of an emergency control device for a linkage door lock according to an embodiment of the present disclosure. Detailed Implementation

[0022] This application describes several embodiments, but these descriptions are exemplary and not limiting, and it will be apparent to those skilled in the art that many more embodiments and implementations are possible within the scope of the embodiments described herein. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with, or may replace, any feature or element of any other embodiment.

[0023] This application includes and contemplates combinations of features and elements known to those skilled in the art. The embodiments, features, and elements disclosed in this application can also be combined with any conventional features or elements to form unique inventive solutions. Any feature or element of any embodiment can also be combined with features or elements from other inventive solutions to form another unique inventive solution. Therefore, it should be understood that any feature shown and / or discussed in this application can be implemented individually or in any suitable combination. Therefore, the embodiments are not limited except by the limitations imposed by the appended claims and their equivalents. Furthermore, various modifications and changes can be made within the scope of the appended claims.

[0024] Furthermore, in describing representative embodiments, the specification may have presented methods and / or processes as a specific sequence of steps. However, the method or process should not be limited to the specific order of steps described herein, to the extent that the method or process does not depend on the specific order of steps described herein. As will be understood by those skilled in the art, other sequences of steps are also possible. Therefore, the specific order of steps set forth in the specification should not be construed as a limitation of the claims. Moreover, the claims relating to the method and / or process should not be limited to the steps performed in the order written, and those skilled in the art will readily understand that these orders can be varied and still remain within the spirit and scope of the embodiments disclosed herein.

[0025] This disclosure provides an emergency control method for a linked door lock, such as... Figure 1 As shown, the method includes: Step 101: In response to the acquisition of an elevator malfunction event, acquire the elevator's operating status data and the personnel detection data inside the car.

[0026] In this embodiment of the disclosure, the fault event is detected and acquired by the elevator control system, the elevator IoT terminal, or the cloud server. Exemplarily, the triggering source includes at least one of the following: an alarm signal triggered by an emergency alarm device when a passenger is trapped inside the car; a fault code reported by the elevator main control board, indicating at least one of door operator malfunction, safety circuit disconnection, or traction machine overheating; a potential fault alarm predicted by the cloud server based on historical operating data; and a maintenance request initiated proactively by maintenance personnel through a terminal device. The elevator IoT terminal is used to collect the fault code and the alarm signal and upload them to the cloud server.

[0027] Operational status data refers to data reflecting the current operating status of the elevator. This data can include the elevator's leveling status, operating speed, car position, and door status. Personnel detection data refers to data used to detect the presence of people inside the elevator car. Personnel detection data can be collected by human body sensors, cameras, infrared sensors, or weight sensors inside the car.

[0028] Step 102: If the elevator is determined to be in a stopped state in a non-leveling area based on the operating status data, and if it is confirmed that there are people in the car based on the personnel detection data, it is determined to be a valid entrapment event.

[0029] In this embodiment, a non-leveling area stop state refers to the state where the elevator car stops at a non-leveling position, meaning there is a deviation between the car's stopping position and the leveling position of any floor, causing the car door to be unable to open normally or posing a risk of falling after opening. Whether the elevator is in a non-leveling area stop state can be determined through operational status data. For example, leveling sensor data can be used to determine whether the car is aligned with the floor leveling position, and operational speed data can be used to determine whether the elevator has stopped. A valid entrapment event refers to an event that confirms that someone is indeed trapped in the elevator. When it is determined that the elevator is in a non-leveling area stop state and there are people in the car, a valid entrapment event can be confirmed. By determining a valid entrapment event, accidental door opening operations caused by false alarms or non-entrapment malfunctions can be avoided.

[0030] Step 103: In response to the valid entrapment event, extract the fault attributes of the fault event and the physical location features of the elevator, and determine the access control node leading to the faulty elevator based on the physical location features.

[0031] In this embodiment of the disclosure, fault attributes refer to information describing the nature and characteristics of a fault event. Fault attributes may include fault type, fault severity, fault occurrence time, fault characteristic data, etc. Physical location characteristics refer to information describing the physical location of the elevator. Physical location characteristics may include the building where the elevator is located, the floor, location coordinates, GIS positioning information, etc.

[0032] Access control nodes leading to the malfunctioning elevator refer to the access control nodes that maintenance personnel must pass through on their physical path from their starting point to the malfunctioning elevator. Access control nodes can be any type of access control node with access control functions, such as building entrances, unit doors, floor corridor doors, elevator lobby doors, or core equipment room doors. Linked door locks can be installed on the access control nodes, and these locks can be controlled to open after successful verification.

[0033] Step 104: Based on the fault attributes, dynamically generate and save an access pass with an expiration date and spatiotemporal constraints, and send the access pass to the terminal device of the designated maintenance personnel; the access pass is used to open the access control node leading to the faulty elevator.

[0034] In this embodiment, the access pass is a digital credential used for verification at access control nodes. The access pass has an expiration date, meaning it can only be used within its valid timeframe and expires after that period. The access pass also has spatiotemporal constraints, meaning it is bound to specific spatial locations and / or temporal conditions. These spatiotemporal constraints mean that the access pass is not only limited by its validity period in the time dimension but also strictly bound to specific physical access control nodes in the spatial dimension. This can include the range of access control nodes the pass can use, the time window it can be used in, and constraints on the identity of maintenance personnel who can use it, ensuring that maintenance personnel can only use the access pass at the correct time and in the correct physical location, thereby achieving precise trajectory control.

[0035] Dynamically generating access credentials based on fault attributes means that the generation of access credentials depends on the attribute information of fault events; different fault events will generate different access credentials. This allows access credentials to be deeply bound to specific physical fault events, improving anti-counterfeiting capabilities.

[0036] Access credentials can be randomly generated token strings, dynamic QR codes, one-time passwords, or other forms of digital credentials, and their content must include at least a credential identifier and validity period information. The validity period can be dynamically adjusted based on the severity of the fault and the estimated repair time. For example, a shorter validity period can be set for general faults, while a longer validity period can be set for serious faults involving the replacement of core components.

[0037] For example, after the access pass is generated, it can be saved to a local database or cloud storage and simultaneously sent to the terminal device of the designated maintenance personnel (such as a mobile app, smart bracelet, or dedicated handheld terminal). The sending method can include push notifications, SMS, email, etc. This access pass is used to open access control devices leading to the malfunctioning elevator, such as physical access control devices like elevator machine room doors, elevator shaft inspection doors, and elevator landing doors, ensuring that only maintenance personnel with valid passes can enter the area where the malfunctioning elevator is located.

[0038] Designated maintenance personnel refer to the maintenance staff assigned to handle the elevator malfunction. The maintenance personnel's terminal devices can be smart devices such as mobile phones, tablets, or wearable devices. These devices may have a dedicated maintenance app, WeChat mini-program, or the ability to receive text messages installed.

[0039] Step 105: Receive a verification request to open the access control node. The verification request carries information to be verified, including the access credential to be verified.

[0040] In this embodiment, the verification request can be initiated by maintenance personnel through their terminal device to the access control node or cloud server, or it can be triggered by maintenance personnel entering access credentials into the input module of the access control device. The information to be verified refers to the information that needs to be verified, including at least the access credentials to be verified. The access credentials to be verified can be credentials in the form of a password, QR code, NFC information, etc., entered by the maintenance personnel.

[0041] Step 106: In response to the verification of the information to be verified, control the access control node to open; wherein, the verification of the information to be verified includes: the access credential to be verified is consistent with the stored access credential, and the request time is within the validity period.

[0042] In this embodiment, upon receiving the verification request, the access credential to be verified is compared with the previously generated and saved access credential. This comparison can be performed on a cloud server or locally at the access control node. Simultaneously, it is necessary to determine whether the verification request time is within the validity period of the access credential. Only when the access credential to be verified matches the saved access credential and the request time is within the validity period is the verification deemed successful, thereby controlling the access control node to open.

[0043] For example, when maintenance personnel arrive at the faulty elevator and attempt to enter through the access control system, they receive a verification request to open the access control. The verification request can be triggered by: the maintenance personnel scanning a QR code reader at the access control point using their terminal device; entering a dynamic password from their access pass on the access keypad; sending the access pass from their terminal device to the access control card reader via NFC or Bluetooth near-field communication; or triggering the verification through biometric verification methods such as facial recognition or fingerprint recognition. The verification request carries at least the access pass to be verified and may also include other auxiliary verification information, such as the maintenance personnel's identity information, a request timestamp, and the access control device's identification, to enhance the security and traceability of the verification.

[0044] In other exemplary instances, the verification of the information to be verified also includes: the number of times the access pass to be verified has been used has not exceeded a preset threshold. The access pass can be set to be used only once or with a limited number of uses. The number of uses is accumulated after each successful verification. When the number of uses reaches the preset threshold, verification is rejected even if the pass is still valid and the content is identical, thereby preventing the pass from being copied and misused multiple times.

[0045] In other exemplary instances, the information to be verified further includes: the device identifier of the access control device initiating the verification request matches the stored authorized device identifier. When generating the access credential, the credential can be bound to a specific access control device (such as the machine room access control corresponding to a faulty elevator). During verification, the access control device reports its own device identifier along with the verification request, and determines whether the device identifier matches the authorized device identifier bound to the credential, preventing the credential from being used to open access control in unauthorized areas.

[0046] In other exemplary instances, the verification information to be verified also includes verifying that the source location of the verification request is within a preset geographical range. This can be achieved by using GPS location information from the terminal device, the physical location information of the floor where the access control device is located, or the strength of near-field communication signals, to determine if maintenance personnel have indeed reached the physical location of the malfunctioning elevator, thus preventing remote initiation of verification requests.

[0047] It should be noted that the emergency control method for the linkage door lock provided in this disclosure can be applied to access control devices or to cloud servers.

[0048] The emergency control method for the linkage door lock provided in this embodiment generates an access pass with an expiration date after detecting an elevator malfunction and sends it to the terminal device of a designated maintenance personnel. This allows maintenance personnel to access the malfunctioning elevator without relying on manual coordination from property management personnel or owners. At the same time, by setting an expiration date and spatiotemporal constraints on the access pass, the timeliness and scope of its use are limited, avoiding the risk of abuse of the access pass. This ensures that maintenance personnel can reach the malfunctioning elevator in a timely manner to handle the situation while ensuring safety.

[0049] In one exemplary instance, the access control node leading to the faulty elevator is determined in the following manner: Obtain the physical location information of the faulty elevator and the departure location information of the designated maintenance personnel; Based on the obtained physical location information of the faulty elevator, the departure location information of the designated maintenance personnel, and the pre-obtained access control location information, and using the building's indoor map, the physical access path that the designated maintenance personnel must pass through is obtained by simulating the physical passage path from the departure location to the faulty elevator. Multiple access control nodes connected in series on the physical passage path are extracted and used as access control nodes leading to the faulty elevator.

[0050] The "building interior map" refers to a digital model that includes the spatial topology of building interior passageways, staircases, elevator shafts, and access control nodes. The "physical travel path" simulated by this map accurately reflects the movement trajectory of maintenance personnel in three-dimensional physical space. For example, the physical location information of a malfunctioning elevator may include the building identification, floor number, and elevator shaft coordinates, which can be directly obtained from fault alarm data from the elevator control system or cloud server. The starting location information of designated maintenance personnel can be obtained through GPS positioning, base station positioning, or Wi-Fi positioning on the maintenance personnel's terminal device (such as a mobile app), or the maintenance personnel can manually input the starting location.

[0051] For example, the pre-obtained access control location information can be stored in a local database or a cloud map. This information includes the geographical coordinates of each access control point within the building, its floor, and associated passageways or areas. In other exemplary instances, the access control location information may also include the type of access control (e.g., card access, password access, biometric access), the access direction attribute (e.g., one-way or two-way access), the current status information of the access control (e.g., normal operation, malfunction, maintenance, etc.), and the association between the access control and elevator equipment (e.g., whether a certain access control is located on a necessary passageway to a specific elevator shaft or machine room). This information can be pre-entered during the building construction or renovation phase.

[0052] For example, the simulation of travel routes can be based on indoor maps of the building and utilize path planning algorithms (such as shortest path algorithms, Dijkstra's algorithm, A*). The algorithm calculates a reasonable path from the starting point to the location of the malfunctioning elevator by comprehensively considering the passageways and floor connection structures within the building (such as stairs, escalators, corridors, elevator lobbies, etc.). When constructing the indoor map, each passageway node within the building (such as entrances / exits, corridor corners, stairwells, elevator lobbies, floor transfer platforms, etc.) can be abstracted as vertices of a graph, and the passageways between nodes can be abstracted as edges of the graph, with each edge assigned a corresponding weight. The weight can be determined based on factors such as passage length, passage time, and passage difficulty. For example, the weight of a stairwell passageway can be higher than that of a corridor passageway on the same floor to reflect the greater time and effort required to traverse between floors.

[0053] For example, when planning access routes, dynamic adjustments can be made based on real-time environmental factors. For instance, if a passageway is temporarily closed due to construction, cleaning, or security control, the corresponding edge of the passageway can be marked as impassable on the indoor map, and an alternative route can be recalculated. If unauthorized personnel are restricted from entering a floor during a specific time period (e.g., office floors require additional access during working hours), this restriction can be incorporated into the route planning constraints to avoid planning routes that are practically impassable. If maintenance personnel are carrying large repair equipment or tools, routes with sufficient passageway width or routes equipped with freight elevators can be prioritized. Furthermore, if maintenance personnel deviate from the preset route while traveling to a malfunctioning elevator, the route can be re-simulated based on their current location, dynamically adjusting the access control points they need to pass through. This dynamic approach to determining access control can adapt to the actual access needs of maintenance personnel in different scenarios, improving the flexibility and intelligence of access control.

[0054] For example, the access path may involve multiple access control nodes. After planning the access path, all access control nodes that need to be passed along the path are identified sequentially, such as building entrance access control nodes, floor passage access control nodes, elevator machine room access control nodes, elevator shaft maintenance door access control nodes, etc., and these access control nodes are identified as access control nodes leading to the malfunctioning elevator. For example, if the maintenance personnel's starting point is the parking lot outside the building, and the malfunctioning elevator is located in the machine room on the 15th floor of the building, then the simulated access path may pass through multiple access control nodes, such as the building entrance access control node, the passage access control node from the lobby to the elevator hall, and the passage access control node from the 15th floor elevator hall to the machine room, and all of these access control nodes are identified as access control nodes leading to the malfunctioning elevator. If the maintenance personnel's starting point is already in the elevator hall on the same floor as the malfunctioning elevator, then the simulated access path may only pass through the machine room access control, and only the machine room access control needs to be identified as the access control node leading to the malfunctioning elevator.

[0055] In one exemplary instance, the step of dynamically generating a pass with an expiration date and spatiotemporal constraints based on the fault attributes includes: Obtain fault characteristic data when the faulty elevator malfunctions; wherein the types of fault characteristic data include at least one of current, voltage, power, vibration, speed, acceleration, temperature, rotational speed, and door status; The fault feature data is used as an encryption seed, combined with a timestamp, to generate a unique rescue work order number. A one-time password uniquely bound to the rescue work order number is generated using a time-based one-time password algorithm (TOTP) or a hash-based message authentication code (HMAC) algorithm, which serves as the access credential, so that the access credential is uniquely bound to a specific physical fault event.

[0056] It should be noted that the "encryption seed" here refers to using the physical characteristics data of the elevator at the moment of malfunction (such as abnormal current values, vibration amplitude, etc.) as input parameters for the cryptographic algorithm. This cross-disciplinary integration method makes the generated access pass not only a string of numbers, but also a digital fingerprint of a specific physical malfunction event, greatly improving its anti-counterfeiting capabilities.

[0057] For example, fault characteristic data of a malfunctioning elevator can be acquired in real time through various sensors and data acquisition modules in the elevator control system. Specifically, current data can be acquired through current transformers or current sensors to reflect the current changes of the elevator motor when a fault occurs, such as overcurrent, phase loss, and abnormal current fluctuations; voltage data can be acquired through voltage sensors to reflect whether there are abnormalities such as undervoltage, overvoltage, or voltage imbalance in the power supply; power data can be calculated based on the product of current and voltage to reflect whether the power output of the elevator drive unit is abnormal; vibration data can be acquired through vibration sensors installed on the traction machine, guide rails, or car to reflect whether there are abnormal vibrations in the elevator mechanical components, such as bearing wear, guide rail deformation, and wire rope vibration; speed data... Data can be collected via encoders or speed sensors to reflect whether the elevator's operating speed exceeds the normal range or fluctuates; acceleration data can be collected via acceleration sensors to reflect whether the elevator's acceleration is abnormal during startup, operation, or braking, such as rapid acceleration or deceleration; temperature data can be collected via temperature sensors to reflect whether the temperature of key components such as the traction machine, control cabinet, and brake exceeds the normal range; speed data can be collected via encoders to reflect whether the speed of the traction machine or guide wheels is abnormal; door status data can be collected via door operator controllers or door position sensors to reflect the elevator door's open / closed status, door lock status, etc. These fault characteristic data can be collected at the moment of the fault or within a time window before and after the fault occurs to comprehensively capture the operating status at the time of the fault.

[0058] For example, in the process of generating a one-time password uniquely bound to the rescue work order number based on the obtained fault feature data and setting a validity period as a pass, the fault feature data can first be analyzed to determine the type and severity of the fault. For instance, if the fault feature data only contains abnormal door status (such as poor door lock contact), the fault type can be determined as a door operator fault, with a low severity; if the fault feature data contains a combination of abnormal current and abnormal temperature, the fault type can be determined as a drive device fault, with a high severity. Subsequently, the validity period of the pass can be determined according to the type and severity of the fault. For example, for faults with low severity, the validity period of the pass can be set to be shorter; for faults with high severity, the validity period of the pass can be set to be longer. In addition, the validity period of the pass can also be determined by combining factors such as the estimated arrival time of maintenance personnel and the estimated time required for fault repair.

[0059] For example, when generating access passes, fault characteristic data can be associated and stored with the access passes for subsequent traceability and auditing. For instance, the access pass may contain information such as the elevator's identification information, the time of the fault, the fault type, and a summary or hash value of the fault characteristic data. This allows the access control system to not only verify the validity and expiration of the access pass but also obtain the fault information associated with it, facilitating property management or maintenance personnel's understanding of the purpose of the maintenance personnel's visit and the background of the fault.

[0060] In other exemplary examples, a pass with an expiration date can be directly generated based on the obtained fault feature data. When generating a pass with an expiration date based on the obtained fault feature data, the fault feature data can be used as seed data to generate a one-time password (OTP) using a preset password generation algorithm, and this one-time password can be used as the pass. Specifically, at least one piece of data from the fault feature data (such as the current value of 12.3A when the fault occurred) or a combination of multiple pieces of data (such as the current value of 12.3A, the temperature value of 78.5℃, the vibration amplitude of 0.12mm / s, etc.) can be combined into a seed string according to a preset concatenation rule. Then, a one-time password can be generated based on the seed string using a time-based one-time password algorithm (TOTP) or a hash-based one-time password algorithm.

[0061] The above embodiments respectively demonstrate the generation of access passes directly using the fault feature data as a seed, and the indirect generation of access passes based on intermediate parameters derived from the fault feature data. Regardless of the generation path used, the fault feature data is a necessary input in the generation process of the access pass. Because the fault feature data is time-sensitive (i.e., valid only at the time of the fault or within a specific time window), and because it belongs to the elevator's internal operating data and cannot be directly obtained by external personnel, the one-time password generated based on this data naturally possesses an expiration date and anti-counterfeiting capabilities. After the expiration date, even if the password itself is not used, it will automatically become invalid due to the expiration of the seed data's time window. Simultaneously, since external personnel cannot obtain specific feature data such as current, temperature, and vibration at the time of the fault, they cannot reconstruct the seed string, thus making it impossible to forge a valid one-time password. When verifying access passes, the access control system can recalculate the one-time password based on the same fault feature data and the same password generation algorithm, and compare it with the access pass presented by maintenance personnel. If they match and are within the validity period, passage is permitted.

[0062] For example, when generating an access pass with an expiration date based on the obtained fault feature data, the fault feature data can be hashed to generate a digital certificate, which can then be used as the access pass. Specifically, the fault feature data and additional information (such as the elevator's identification information, the time of the fault, the maintenance personnel's identification, and the validity period's start and end dates) can be combined into data to be signed according to a preset data format. Then, a preset hash algorithm (such as SHA-256, SHA-3, etc.) is used to hash this data to generate a hash digest. Subsequently, a pre-configured private key can be used to digitally sign the hash digest, generating a digital certificate. This digital certificate contains the hash digest of the fault feature data, the digital signature, the validity period information, and the maintenance personnel's identification information. When verifying the access pass, the access control system can use the corresponding public key to verify the digital signature in the digital certificate, confirming that the access pass was indeed issued by the authorized credential generator. It also verifies whether the validity period information is within the current time range and whether the hash digest of the fault feature data matches the actual fault feature data of the faulty elevator stored locally by the access control system. If all the above verifications pass, access is granted.

[0063] In other exemplary instances, multiple generation methods can be combined to enhance security when generating access credentials based on fault feature data. For example, a one-time password and a digital certificate can be generated simultaneously, requiring maintenance personnel to present both credentials when passing through access control. Access is only granted after both credentials are successfully verified. Furthermore, fault feature data can be linked to the biometric information of maintenance personnel (such as fingerprints or facial recognition) to generate access credentials containing biometric templates. This ensures that the access credentials are associated not only with a specific fault but also with a specific maintenance personnel, further enhancing the security and non-transferability of the access credentials.

[0064] In one exemplary instance, the verification of the information to be verified further includes: the identity information to be verified is consistent with the pre-stored identity information of the designated maintenance personnel.

[0065] For example, the information to be verified may also include identity information to be verified, which can be used to confirm whether the person requesting access is an authorized designated maintenance personnel. Specifically, the identity information to be verified may include at least one of the maintenance personnel's basic identity information such as employee number, name, and affiliated maintenance unit, or at least one of the maintenance personnel's biometric information (such as authorized fingerprints, facial images, iris images, voiceprints, etc.). Upon receiving an access request, the identity information to be verified can be extracted and compared with the pre-stored identity information of designated maintenance personnel. For example, if the identity information to be verified is the maintenance personnel's employee number, it can be matched with a list of authorized maintenance personnel employee numbers stored locally or obtained from the cloud; if the identity information to be verified is the maintenance personnel's facial image, it can be compared with a pre-stored maintenance personnel facial template using a facial recognition algorithm to calculate the similarity. When the identity information to be verified matches the pre-stored identity information of the designated maintenance personnel (such as successful matching of employee ID or facial similarity exceeding a preset threshold), it can be confirmed that the person requesting passage is an authorized designated maintenance personnel, and the identity verification is successful.

[0066] In other exemplary instances, the authentication process can be supplemented by the maintenance personnel's scheduling information or task order information. For example, when verifying the identity of a maintenance personnel, the access control system can not only confirm whether the person is a pre-stored authorized maintenance personnel, but also further confirm whether the maintenance personnel have been assigned a maintenance task related to the malfunctioning elevator. Specifically, the maintenance personnel's task order information can be obtained. This task order information may include the identifier of the malfunctioning elevator assigned to the maintenance personnel, the task time range, etc. If the task order of the maintenance personnel to be verified contains the identifier of the currently malfunctioning elevator, and the current time is within the task time range, it can be further confirmed that the maintenance personnel have access rights. This multi-factor authentication mechanism can effectively prevent authorized maintenance personnel from abusing access rights during non-task periods or for non-task elevators, further improving the security of access control.

[0067] In other exemplary instances, the identity information to be verified can be transmitted and verified through encryption or tokenization to prevent interception or tampering during transmission. For example, maintenance personnel's terminal devices can encrypt the identity information locally and send the encrypted information as part of the verification information to the access control system. Upon receiving the encrypted identity information, the access control system decrypts it using a pre-set decryption key and then compares it with pre-stored maintenance personnel identity information. Alternatively, the maintenance personnel's terminal devices can generate a time-limited identity token based on the identity information. The access control system verifies the maintenance personnel's identity by verifying the token's signature and validity period, without directly transmitting and storing the maintenance personnel's original identity information, thereby reducing the risk of identity information leakage.

[0068] For example, after successful authentication, the access control system can also record log information about the passage, including the identity of the verified maintenance personnel, the passage time, and the access control location. This log information is then uploaded to the cloud or a local database for storage, enabling subsequent access auditing and anomaly investigation. If authentication fails, the access control system can refuse the access request and generate an alarm message to notify property management personnel or security personnel for further verification and handling.

[0069] To further enhance security, the method also includes multi-factor authentication and anti-bombing mechanisms. In one exemplary instance, the identity information includes: NFC identification information of maintenance personnel's employee badges; the method further includes: locking the access control node for a preset duration when the number of incorrect inputs of the access credential reaches a preset limit, or when the NFC identification information of the maintenance personnel's employee badge does not match the pre-stored NFC identification information of the maintenance personnel's employee badge. In actual elevator rescue scenarios, access control nodes may experience communication interruptions due to network failures, signal obstruction, or equipment malfunctions. To ensure the absolute unobstructed flow of the rescue channel, it is necessary to still be able to verify the access credential when the access control node is offline. Therefore, this embodiment of the disclosure specifically designs an offline verification degradation mechanism for extreme environments. Specifically, when the access control node is in its normal network state, the credential generation key is pre-issued to the access control node and stored locally. At the same time as or before the credential generation key is issued, the access control node also pre-synchronizes from the cloud and stores locally the most recently issued offline credential generation algorithm and fault characteristic benchmark data. When it is determined that a certain access control node leading to the malfunctioning elevator is in an offline state with communication interruption, the system automatically switches to offline verification mode. Based on the credential generation key and the fault feature benchmark data, an access credential with an expiration date and spatiotemporal constraints is generated using the offline credential generation algorithm. This credential is then saved and sent to the designated maintenance personnel's terminal device. The maintenance personnel's terminal device then presents the offline access credential to the access control node. The access control node uses the locally stored credential generation key and fault feature benchmark data to generate a local comparison credential using the offline credential generation algorithm. This credential is compared with the offline access credential (i.e., the access credential presented by the maintenance personnel's terminal device to the access control node), and if the comparison passes, the access control node in the offline state is opened, ensuring that rescue operations are not limited by the network environment.

[0070] When the offline credential generation algorithm is AES, the cloud uses the credential generation key as the AES encryption key to encrypt the fault characteristic baseline data, generating encrypted ciphertext, which is then used as the offline access credential. When maintenance personnel present the offline access credential to the access control node using their terminal device, the access control node uses the locally stored credential generation key as the AES encryption key to encrypt the locally stored fault characteristic baseline data, generating encrypted ciphertext, which is then used as the local comparison credential for comparison with the offline access credential. The offline credential generation algorithm can also be the HMAC-SHA256 algorithm. When the offline credential generation algorithm is the HMAC-SHA256 algorithm, the cloud uses the credential generation key as the HMAC key to perform HMAC-SHA256 operation on the fault feature benchmark data to generate a message authentication code, and uses this message authentication code as the offline access credential. When the maintenance personnel's terminal device presents the offline access credential to the access control node, the access control node uses the locally stored credential generation key as the HMAC key to perform HMAC-SHA256 operation on the locally stored fault feature benchmark data to generate a message authentication code, and uses this message authentication code as the local comparison credential to perform a consistency comparison with the offline access credential.

[0071] Whether an access control node is in an offline state due to communication interruption can be detected by the cloud in the following ways: the cloud periodically sends heartbeat probe messages to the access control node, and if no response is received from the access control node within a preset time, the access control node is determined to be in an offline state due to communication interruption; or, the cloud monitors the status information, fault data, or location characteristics reported by the access control node, and if no valid data is received from the access control node within a preset time, the access control node is determined to be in an offline state.

[0072] Furthermore, to prevent access credentials from being screenshotted and forwarded or remotely stolen, this embodiment also introduces an NFC dual authentication mechanism. The access control node not only requires the input or presentation of an access credential, but also reads the NFC identification information of the physical work badge worn by maintenance personnel through a built-in NFC reader. The NFC identification information (representing "physical presence" and "legitimate identity") is then dual-bound and verified with the access credential to be verified (representing "legitimate task"). Simultaneously, the access control node is equipped with an anti-brute-force locking mechanism. When the number of incorrect access credential inputs reaches a preset limit (e.g., 5 consecutive incorrect inputs), the access control will automatically lock for a preset time (e.g., 15 minutes), during which time no input will be accepted, thus completely eliminating the risk of brute-force attacks.

[0073] In one exemplary instance, the access control to the malfunctioning elevator includes: a plurality of first access control points that the designated maintenance personnel must pass through sequentially along the access path; the access pass includes: a sub-access pass corresponding to each of the first access control points; Sending the generated access pass to the terminal device of the designated maintenance personnel includes: Based on the physical access path from the starting position to the faulty elevator, the multiple first access control nodes are sorted according to the order of passage, and the sub-access pass corresponding to the first first access control node is sent to the terminal device of the designated maintenance personnel. Only after receiving a callback signal indicating that the sub-access pass corresponding to the current first access control node has been verified will the sub-access pass corresponding to the next first access control node in the sequence be sent to the terminal device of the designated maintenance personnel.

[0074] For example, the access pass can include sub-access passes corresponding to each first access control node. That is, each first access control node corresponds to an independent sub-access pass, and each sub-access pass is only used to open its corresponding first access control node and cannot be used to open other access control nodes. This method of splitting the access pass into multiple sub-access passes can achieve fine-grained control over the access range of maintenance personnel, and prevent maintenance personnel from obtaining access control permissions beyond their actual access needs.

[0075] The sub-access mechanism adopted in this embodiment can be viewed as a hierarchical trust chain based on spatial topology. "Hierarchical trust chain distribution" refers to using the spatial topology of the building's interior map to connect multiple access control nodes in series. When issuing credentials, a callback signal confirming successful verification from the preceding physical access control node (such as the community gate) must be received before subsequent nodes (such as unit doors or machine room doors) are activated and issued access credentials, forming a trust chain that cannot be skipped in physical space. For example, the access control nodes leading to a faulty elevator may include multiple first access control nodes that maintenance personnel must sequentially pass through on their access path. For example, if maintenance personnel depart from the parking lot outside the building, and the faulty elevator is located in the machine room on the 15th floor, the first access control nodes they pass through along the route may include the building entrance access control node, the access control node from the lobby to the elevator hall, and the access control node from the 15th-floor elevator hall to the machine room. When the designated maintenance personnel arrive at the building entrance access control node, they present the corresponding first sub-access pass to the building entrance access control node through the terminal device. The building entrance access control node verifies the first sub-access pass and generates and reports a verification pass callback signal when the verification is successful. After receiving the verification pass callback signal, the cloud server activates and sends the next sub-access pass corresponding to the access control node from the lobby to the elevator hall to the terminal device, and so on, until the sub-access pass corresponding to the access control node from the 15th-floor elevator hall to the machine room is sent.

[0076] For example, a timeout mechanism can be set during the process of issuing sub-access passes level by level. For instance, if a maintenance worker obtains a sub-access pass corresponding to a first access control node but fails to pass through that node within a preset time threshold (i.e., the sub-access pass is not verified), it can be determined that the maintenance worker may have deviated from the preset access path or encountered an anomaly. In this case, the issuance of subsequent sub-access passes can be suspended, and an alarm notification can be sent to the property management personnel or maintenance management personnel to promptly verify the actual location and status of the maintenance worker. Furthermore, if the maintenance worker deviates from the preset access path during passage, the access path can be re-simulated based on the maintenance worker's current location, and the first access control nodes can be reordered according to the new access path, re-executing the process of issuing sub-access passes level by level.

[0077] In other exemplary instances, each first access control node, when verifying the sub-access credential, can also report the verification result (including verification success or failure, verification time, maintenance personnel identity, etc.) to the cloud or local database for recording, forming a complete access log. This access log can be used for subsequent access audits, anomaly investigations, and performance evaluations of maintenance personnel. For example, if the access log shows that a maintenance personnel failed to verify multiple times at a certain first access control node, it can indicate that the access control node may be faulty or that the maintenance personnel's terminal device may be malfunctioning; if the access log shows that the maintenance personnel's access time deviates significantly from the expected access time, it can indicate that the maintenance personnel may have taken a detour or been delayed.

[0078] In one exemplary instance, the validity period of the access pass is set by setting a dynamic validity period independently for each sub-access pass corresponding to each first access control node on the physical access path; The dynamic validity period of the sub-access pass corresponding to each first access control node is set in the following way: For the first access control node on the physical access path, the distance between the designated maintenance personnel and the first access control node is determined based on their departure location information and the location information of the first access control node, and is set based on the distance between them and the expected departure time. For each of the first access control nodes on the physical access path other than the first access control node, the physical walking distance between the two nodes is determined based on the location information of the current access control node and the location information of the previous access control node. The distance between the two nodes is dynamically calculated and set based on the physical walking distance and the expected walking speed.

[0079] For example, when setting an expiration date for a pass, the expiration date can be set separately for each sub-pass corresponding to the first access control node on the access path, instead of setting the same expiration date for all sub-passes. This method of setting the expiration date independently for each access control node can more accurately control the passage time window for maintenance personnel at each access control node, avoiding security risks caused by an excessively long expiration date for a certain sub-pass.

[0080] For example, for the first access control node on the passage path, the distance between the designated maintenance personnel and the first access control node is determined based on the departure location information of the designated maintenance personnel and the location information of the first access control node. The dynamic validity period of the corresponding sub-access pass is then set based on this distance and the designated maintenance personnel's expected departure time. Specifically, the distance can be the straight-line distance between the departure location and the first access control node, or the actual passage path distance between them. Combining the designated maintenance personnel's expected travel speed, the passage time required to reach the first access control node from the departure location is estimated. This passage time is then added to the expected departure time to obtain the start and end times of the dynamic validity period, with a buffer time reserved within it. For example, if the designated maintenance personnel's expected departure time is 10:00 AM, and the passage time required to reach the building entrance access control node is approximately 5 minutes, then the dynamic validity period of the sub-access pass can be set from 10:00 AM to 10:15 AM. If the first access control node is not passed within the dynamic validity period, the sub-access pass becomes invalid.

[0081] For example, for each of the first access control nodes on the physical access path other than the first access control node, the physical walking distance between the current access control node and the previous access control node is determined based on the location information of the current access control node and the location information of the previous access control node. Based on the physical walking distance and the expected walking speed, the dynamic validity period of the sub-access pass corresponding to the current access control node is dynamically calculated and set. Specifically, the passage time required to reach the current access control node from the previous access control node is estimated, and the dynamic validity period is determined by taking the verification time of the previous access control node as the starting point and adding a buffer time to the passage time. For example, if maintenance personnel need to walk to the passage access control node from the lobby to the elevator hall after passing through the building main entrance access control node, and the passage time between the two is approximately 2 minutes, then the dynamic validity period of the sub-access pass corresponding to the passage access control node can be set to within 5 minutes after verification. Since the physical walking distance between each adjacent access control node is different, the dynamic validity periods of each sub-access pass are different.

[0082] In other exemplary instances, the dynamic validity period of each of the sub-access passes can be dynamically adjusted: if the physical access path includes a floor transfer step, then the elevator waiting time is reserved in the dynamic validity period of the corresponding sub-access pass; and / or, the dynamic validity period is corrected based on the average time taken by the designated maintenance personnel to pass through each first access control node in historical access data.

[0083] In other exemplary instances, the validity period of each sub-access pass can also be linked to the validity period of the access pass generated based on the aforementioned fault feature data. For example, if the overall validity period of the access pass generated based on the fault feature data is 4 hours, then the sum of the validity periods of each sub-access pass should not exceed the overall validity period, to ensure that maintenance personnel can complete the passage of all access control systems before the overall validity period expires.

[0084] In one exemplary instance, the fault event includes: a first fault event requiring multiple maintenance personnel to work together to repair it; when the detected fault event is the first fault event, the designated maintenance personnel are multiple; The step of sending the access pass to the terminal device of the designated maintenance personnel includes: Send the corresponding access pass to the terminal device of each designated maintenance personnel. The access pass for each designated maintenance personnel includes: sub-access passes corresponding to multiple first access control nodes that the designated maintenance personnel need to pass through sequentially on their physical access path; the physical access path of the designated maintenance personnel is obtained by simulating the process of the designated maintenance personnel starting from the starting position and arriving at the faulty elevator. The verification of the pending information at the first access control node at the end of the core machine room where the faulty elevator is located is completed, including receiving a callback signal indicating that the pending information sent by all designated maintenance personnel through their respective terminal devices has been verified.

[0085] For example, a fault event can include a first fault event that requires multiple maintenance personnel to work together to repair it. For instance, when the faulty elevator has a complex fault type such as a drive unit failure, safety circuit failure, or control cabinet failure, a single maintenance personnel may not be able to complete the repair independently, requiring multiple maintenance personnel with different professional skills, such as mechanical maintenance personnel, electrical maintenance personnel, and software debugging personnel, to work together. Similarly, when the faulty elevator is located in the top-floor machine room of a high-rise building, and the repair involves replacing large components (such as traction machine replacement, wire rope replacement, etc.), requiring multiple maintenance personnel to cooperate in handling and installation, this fault event can also be identified as the first fault event.

[0086] For example, when the detected fault event is the first fault event, corresponding access passes can be generated for each designated maintenance personnel, and the generated access passes can be sent to the terminal devices of each designated maintenance personnel. Specifically, each designated maintenance personnel may have different starting locations. Therefore, when generating access passes for each designated maintenance personnel, a separate travel route can be planned for each maintenance personnel based on their starting location information, and a corresponding access pass can be generated according to their respective travel routes. For example, if the first fault event requires three maintenance personnel (maintenance personnel A, maintenance personnel B, and maintenance personnel C) to repair together, and maintenance personnel A starts from the parking lot outside the building, maintenance personnel B starts from the property office inside the building, and maintenance personnel C comes from an adjacent building, then separate travel routes can be planned for each of the three maintenance personnel, and corresponding access passes can be generated for each, and sent to the terminal devices of each of the three personnel respectively.

[0087] For example, for the first access control nodes on the physical access path other than the final first access control node, each designated maintenance personnel independently presents their corresponding sub-access pass and completes the verification separately. For the final first access control node leading to the core machine room where the faulty elevator is located, the verification information of the final first access control node is determined to be verified only when a callback signal is received indicating that the verification information sent by all designated maintenance personnel through their respective terminal devices has been successfully verified, and the final first access control node is opened; if the verification information of any designated maintenance personnel fails verification, the final first access control node remains closed. This ensures that all maintenance personnel involved in the fault repair have arrived at the core machine room before access is opened, preventing individual personnel from entering the faulty area alone and failing to meet the safety requirements of collaborative work.

[0088] In actual implementation, an attendance counter corresponding to the first fault event can be maintained, and incremented upon receiving a callback signal indicating that each designated maintenance personnel has passed verification at the first access control node at the end. When the attendance counter reaches the total number of designated maintenance personnel, an opening command is issued to the first access control node at the end. If the count value does not reach the total number within the preset assembly time, the collaborative passage is terminated, the sub-access tokens corresponding to each designated maintenance personnel become invalid, and a staff shortage record is reported to the management backend.

[0089] In other exemplary instances, access control nodes can also record log information for this collaborative access, including the identities of all verified maintenance personnel, their arrival times, the locations of the access control nodes used, and associated fault event identifiers. This log information is then uploaded to the cloud or a local database for storage. This log information can be used for subsequent access audits, maintenance work records, and accountability. For example, if a safety incident or repair quality issue occurs during fault repair, the access log can be used to confirm the list of maintenance personnel involved in the work and their arrival times, thus clarifying the responsibilities of each party.

[0090] In one exemplary instance, after sending the generated access credential to the terminal device of the designated maintenance personnel, the method further includes: Receive a renewal request sent from the terminal device of the designated maintenance personnel; If the renewal request is initiated within the set validity period, the validity period of the pass is extended; In response to the situation where the renewal request is initiated after the set validity period, a new access pass is generated, a validity period is set for the new access pass, and the new access pass is sent to the terminal device of the designated maintenance personnel.

[0091] For example, after sending the generated access pass to the designated maintenance personnel's terminal device, a pass renewal mechanism can also be supported to address situations where maintenance personnel need to extend their access time for various reasons during fault repair. Specifically, a renewal request can be received from the designated maintenance personnel's terminal device. This renewal request can be initiated proactively by the maintenance personnel through an application on their terminal device, or it can be automatically triggered by the terminal device when the access pass is about to expire and the maintenance personnel have not yet sent a verification request to the access control system. The renewal request can include the current access pass's identification information, the maintenance personnel's identity information, and the reason for renewal, so that the renewal request can be verified and approved subsequently.

[0092] For example, upon receiving a renewal request, it can be determined whether the request was initiated within the validity period set for the current access pass. If the request was initiated within the validity period, it means the maintenance personnel are still within a valid access time window, and the access pass's validity period can be extended. For instance, if the current access pass's validity period is from 10:00 AM to 11:00 PM, and the maintenance personnel initiate a renewal request at 10:30 AM, since the initiation time is within the validity period, the access pass's validity period can be extended to 12:00 PM or later. The extension duration can be determined based on factors such as the estimated remaining time for fault repair and the duration of the maintenance personnel's application. When extending the validity period, the validity period of the sub-access passes corresponding to each access control point on the access path can also be adjusted according to actual needs to ensure consistency with the extended overall validity period.

[0093] For example, if the renewal request is initiated after the validity period set on the pass, it means the pass has expired. In this case, the original pass is not extended; instead, a new pass is generated, a new validity period is set for the new pass, and the new pass is sent to the designated maintenance personnel's terminal device. For instance, if the pass's validity period is from 10:00 AM to 11:00 AM, and the maintenance personnel initiate a renewal request at 11:10 AM, the original pass has expired and needs to be regenerated. The regenerated pass can replan the travel route based on the maintenance personnel's current location information, set a new validity period, and then be sent to the maintenance personnel's terminal device. This differentiated processing mechanism can conveniently extend the travel time within the validity period, and ensure the integrity of security audits by regenerating expired passes, preventing expired passes from being maliciously renewed and exploited.

[0094] In other exemplary instances, an approval mechanism can be set up for processing renewal requests. For example, if the extension period exceeds a preset threshold (e.g., more than 2 hours), it requires approval and confirmation from property management or maintenance management personnel before it takes effect; if the extension period is within the threshold, it can be automatically approved. The approval result can be notified to maintenance personnel via terminal devices. If the approval fails, maintenance personnel need to contact management personnel for communication or resubmit the renewal application. Each renewal operation (including the time the renewal request was initiated, the approval result, and the extended validity period) can be recorded in the access log for subsequent access auditing and anomaly investigation.

[0095] This disclosure also provides an emergency control device for a linked door lock, such as... Figure 2 As shown, it includes: Processing module 21 is used to respond to the acquisition of an elevator malfunction event, and to acquire the elevator's operating status data and personnel detection data inside the car; based on the operating status data, it is determined that the elevator is in a stopped state in a non-leveling area, and based on the personnel detection data, it is confirmed that there are people inside the car, which is then determined as a valid entrapment event; in response to the valid entrapment event, the malfunction attributes of the malfunction event and the physical location features of the elevator are extracted, and based on the physical location features, an access control node leading to the malfunctioning elevator is determined; based on the malfunction attributes, a pass with an expiration date and spatiotemporal constraints is dynamically generated and saved, and the pass is sent to the terminal device of the designated maintenance personnel; The receiving module 22 is used to receive a verification request for opening the access control node, the verification request carrying information to be verified, the information to be verified including the access credential to be verified; Control module 23 is used to control the access control node to open in response to the verification of the information to be verified; wherein, the verification of the information to be verified includes: the access credential to be verified is consistent with the stored access credential, and the request time is within the validity period.

[0096] This disclosure also provides an emergency control device for a linked door lock, comprising: a memory and a processor, wherein the memory is configured to store an executable program; The processor is configured to read and execute the executable program to perform the emergency control method of the linkage door lock according to any embodiment of the present disclosure.

[0097] This disclosure also provides a storage medium in which a computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it can implement the emergency control method for the linkage door lock as described in any of the above embodiments.

[0098] This disclosure also provides an emergency control system for a linked door lock. When an elevator entrapment occurs, the trapped passenger presses the emergency alarm button (bell) inside the car. The alarm signal is uploaded to a cloud server via the elevator IoT system. The cloud server automatically identifies the entrapment event and generates a rescue work order, while simultaneously generating a one-time unlocking password, which is sent to designated maintenance personnel via SMS, APP push, or other means. Upon arrival at the scene, maintenance personnel can enter the one-time password on the door lock to unlock it and enter the rescue area to carry out the rescue. The password expires after one use and has a strict validity period.

[0099] For example, the emergency control system for the interlocking door lock provided in this disclosure embodiment may include the following components: 1. An elevator emergency alarm device (alarm bell button) is installed inside the elevator car for trapped passengers to trigger the alarm; 2. Elevator IoT terminal, responsible for collecting alarm signals and uploading them to the cloud, supports 4G / 5G or wired network communication; 3. Cloud server, used to receive alarms, generate one-time passwords, manage rescue work orders, and record the entire process log; 4. Smart door locks, installed at the entrance of the building where the elevator is located (such as the entrance door, room door, etc.), support one-time password input; 5. Maintenance personnel's terminal receives a one-time password and rescue mission information via mobile APP or SMS; 6. Management backend, for property management or maintenance units to monitor rescue progress and query historical records.

[0100] For example, the emergency control system for the interlocking door lock provided in this disclosure includes the following aspects: 1. Password generation algorithm The cloud server uses either a Time-Based One-Time Password (TOTP) algorithm or a Hash-Based Message Authentication Code (HMAC) algorithm to generate one-time passwords. These passwords have the following characteristics: each generated password is unique and unpredictable; each password is uniquely linked to a specific rescue work order; the password is valid for a preset duration (e.g., 30 minutes) and automatically expires after that time; and the password expires immediately after one use and cannot be reused.

[0101] 2. Password distribution method The cloud server sends the one-time password to maintenance personnel in the following ways: Method 1: SMS push, sending the password to the mobile phone number reserved by the maintenance personnel; Method 2: APP push, pushing the password and rescue mission details to the maintenance personnel through the dedicated maintenance APP; Method 3: WeChat mini-program push, sending notifications to the maintenance personnel through the mini-program.

[0102] 3. Password Input and Verification The smart lock has a built-in password input module (physical keypad or touchscreen). Maintenance personnel enter a one-time password upon arrival. The lock then compares the entered password with a valid password stored locally or sent from the cloud. If the verification is successful, the lock will unlock.

[0103] In one exemplary instance, the method further includes an offline verification degradation mechanism for extreme environments: A credential generation key is pre-synchronized and stored locally on the access control system; the access control node is locally pre-configured with an offline credential generation algorithm synchronized with the cloud and fault characteristic benchmark data; when it is determined that an access control node leading to a faulty elevator is in an offline state with communication interruption, based on the credential generation key and the fault characteristic benchmark data, an access credential with an expiration date and spatiotemporal constraints, used to open the offline access control node, is generated and saved as an offline access credential, and sent to the terminal device of a designated maintenance personnel; when the terminal device presents the offline access credential to the offline access control node, based on the locally stored credential generation key and fault characteristic benchmark data, a local comparison credential is generated in real time using the offline credential generation algorithm, compared with the offline access credential, and the offline access control node is opened when the comparison passes. Exemplarily, the emergency control system for the linkage door lock provided in this embodiment includes the following steps: Step 1: Triggering the entrapment alarm When a trapped passenger presses the emergency alarm button (bell) inside the elevator car, the alarm signal is uploaded to the cloud server in real time via the elevator's IoT terminal. The alarm information includes: elevator number, location (including GIS positioning information), and alarm time.

[0104] Step Two: Confirm the entrapment incident via cloud platform After receiving the alarm signal, the cloud server confirms the authenticity of the entrapment incident through the following methods: detecting the elevator's operating status (whether it has stopped, whether it is in a non-leveling area, etc.); detecting whether there are people in the car (using human body sensors or cameras inside the car to assist in the judgment); if it is determined to be a valid entrapment incident, the rescue process is initiated immediately.

[0105] Step 3: Generate a rescue work order and a one-time password The cloud server will automatically perform the following operations: 1. Generate a unique rescue work order number; 2. Obtain the bound maintenance personnel information (contact information, affiliated unit, etc.) based on the elevator number; 3. Call the one-time password generation algorithm to generate a unique one-time password bound to this work order; 4. Set a password validity period (e.g., 30 minutes) and store the password in association with the work order.

[0106] Step 4: Notify maintenance personnel The cloud server sends rescue information to maintenance personnel in the following ways: Rescue mission information: location of the elevator where people are trapped, information on the trapped people (if any), and route to the rescue site; One-time password: a temporary password used to unlock the door; Validity period reminder: clearly indicating the validity period of the password.

[0107] Step 5: Maintenance personnel arrive at the site and open the door. After the maintenance personnel arrive at the site, they will perform the following operations: 1. Enter the received one-time password on the smart lock; 2. The door lock will automatically open after the password is verified. 3. The door lock sends unlocking records (unlocking time, operator, etc.) to the cloud.

[0108] Step Six: Implement Rescue After entering the building, maintenance personnel will reach the location of the elevator and carry out the rescue according to standard rescue procedures (such as opening the landing door through the emergency unlocking device, leveling the elevator, etc.) to rescue the trapped personnel.

[0109] Step 7: Rescue Completion and Work Order Closure 1. Maintenance personnel confirm the completion of the rescue through the APP or management backend; 2. Record the rescue completion time in the cloud and close the work order; 3. One-time passwords become invalid immediately (even if they have not expired); 4. The system generates a complete rescue log for post-event traceability.

[0110] Compared with related technologies, the emergency control method, device, and storage medium for the interlocking door lock provided in this disclosure have the following advantages: 1. Deep Binding of Physical Faults and Digital Access Control: This invention breaks through the limitations of traditional access control systems that randomly generate temporary passwords. It innovatively extracts the fault attributes and physical location characteristics of the elevator's underlying hardware and uses them as trigger conditions and encryption seeds. This cross-industry integration makes the generated access credentials not only a string of numbers but also a "digital fingerprint" of a specific physical fault event, greatly improving anti-counterfeiting capabilities and the system's inherent security.

[0111] 2. Achieving Precise Trajectory Control Based on Spatial Topology: This disclosure introduces spatiotemporal constraints and building interior maps, connecting multiple access control nodes leading to the malfunctioning elevator into a physical access path, and implementing a hierarchical trust chain. Maintenance personnel must unlock each node sequentially according to the physical spatial order; if the preceding node is not unlocked, the credentials for subsequent nodes will not be activated. This completely solves the security risks of traditional temporary passwords, which are characterized by "one-time issuance unlocks all and uncontrollable authorization scope," preventing maintenance personnel from moving freely in unauthorized areas within the building.

[0112] 3. Enhanced Reliability of Rescue Operations in Extreme Environments: This invention innovatively introduces an offline verification degradation mechanism for areas with frequent communication interruptions and no network signal, such as elevator shafts and basements. Through a locally pre-configured offline credential generation algorithm and fault characteristic benchmark data, consistency comparison and unlocking can still be completed even in network-disconnected conditions, bridging the last mile of emergency rescue and ensuring unimpeded lifelines in extreme environments.

[0113] 4. Achieve a secure closed loop of multi-entity collaboration: For complex and severe faults, this disclosure designs a multi-entity collaborative verification mechanism, requiring that the credentials of multiple collaborative maintenance personnel be verified before the access control of the core computer room is opened, thus meeting the joint authorization compliance requirements for high-risk operations of special equipment.

[0114] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

Claims

1. An emergency control method for a linked door lock, characterized in that, The method includes: In response to the detection of an elevator malfunction event, the system acquires the elevator's operating status data and the personnel detection data inside the car. When the elevator is determined to be stopped in a non-leveling area based on the operating status data, and when it is confirmed that there are people in the car based on the personnel detection data, it is determined to be a valid entrapment event. In response to the valid entrapment event, the fault attributes of the fault event and the physical location features of the elevator are extracted, and the access control node leading to the faulty elevator is determined based on the physical location features; Based on the fault attributes, a pass with an expiration date and spatiotemporal constraints is dynamically generated and saved. The pass is then sent to the terminal device of the designated maintenance personnel. The pass is used to open the access control node leading to the faulty elevator. Receive a verification request for opening the access control node, the verification request carrying information to be verified, the information to be verified including the access credential to be verified; In response to the verification of the information to be verified, the access control node is opened; wherein, the verification of the information to be verified includes: the access credential to be verified is consistent with the stored access credential, and the request time is within the validity period.

2. The method according to claim 1, characterized in that, The access control node leading to the faulty elevator is determined in the following way: Obtain the physical location information of the faulty elevator and the departure location information of the designated maintenance personnel; Based on the obtained physical location information of the faulty elevator, the departure location information of the designated maintenance personnel, and the pre-obtained access control location information, and using the building's indoor map, and by simulating the physical passage path of the designated maintenance personnel from their departure location to the faulty elevator, multiple access control nodes connected in series on the physical passage path are extracted and used as access control nodes leading to the faulty elevator.

3. The method according to claim 1, characterized in that, The process of dynamically generating a pass with an expiration date and spatiotemporal constraints based on the fault attributes includes: Obtain fault characteristic data when the faulty elevator malfunctions; wherein the types of fault characteristic data include at least one of current, voltage, power, vibration, speed, acceleration, temperature, rotational speed, and door status; The fault characteristic data is used as an encryption seed, combined with a timestamp, to generate a unique rescue work order number. A one-time password uniquely bound to the rescue work order number is generated using a time-based one-time password algorithm or a hash-based message authentication code algorithm, and an expiration period is set. The one-time password with an expiration period is used as the access credential.

4. The method according to claim 1, characterized in that, The verification of the information to be verified also includes: the identity information to be verified is consistent with the pre-stored identity information of the designated maintenance personnel.

5. The method according to claim 4, characterized in that, The identity information includes: NFC identification information of the maintenance personnel's employee ID card; The method further includes: When the number of incorrect entries for the access pass reaches a preset limit, or when the NFC identification information of the maintenance personnel's employee ID card does not match the pre-stored NFC identification information of the maintenance personnel's employee ID card, the access control node is locked for a preset duration.

6. The method according to claim 1, characterized in that, The method further includes: The credential generation key is pre-distributed to the access control node and stored locally. The access control node is pre-configured with an offline credential generation algorithm and fault characteristic benchmark data synchronized with the cloud. When it is determined that a certain access control node leading to the faulty elevator is in an offline state with communication interruption, based on the credential generation key and the fault feature benchmark data, an access credential with an expiration date and spatiotemporal constraints is generated by the offline credential generation algorithm and used to open the access control node in the offline state. This credential is then saved and sent to the terminal device of the designated maintenance personnel. When the terminal device presents the offline access pass to the offline access control node, it generates a local comparison pass in real time based on the locally stored pass generation key and fault feature benchmark data, and performs a consistency comparison with the offline access pass. When the comparison is successful, it controls the offline access control node to open.

7. The method according to claim 2, characterized in that, The access control nodes leading to the faulty elevator include: multiple first access control nodes that the designated maintenance personnel must pass through sequentially on the physical access path; the access credentials include: sub-access credentials corresponding to each of the first access control nodes; The step of sending the access pass to the terminal device of the designated maintenance personnel includes: Based on the physical access path from the starting position to the faulty elevator, the multiple first access control nodes are sorted according to the order of passage, and the sub-access pass corresponding to the first first access control node is sent to the terminal device of the designated maintenance personnel. Only after receiving a callback signal indicating that the sub-access pass corresponding to the current first access control node has been verified will the sub-access pass corresponding to the next first access control node in the sequence be sent to the terminal device of the designated maintenance personnel.

8. The method according to claim 7, characterized in that, The validity period of the access pass is set in the following way: a dynamic validity period is set independently for each sub-access pass corresponding to each first access control node on the physical access path; The dynamic validity period of the sub-access pass corresponding to each first access control node is set in the following way: For the first access control node on the physical access path, the distance between the designated maintenance personnel and the first access control node is determined based on their departure location information and the location information of the first access control node, and is set based on the distance between them and the expected departure time. For each of the first access control nodes on the physical access path other than the first access control node, the physical walking distance between the two nodes is determined based on the location information of the current access control node and the location information of the previous access control node. The distance between the two nodes is dynamically calculated and set based on the physical walking distance and the expected walking speed.

9. The method according to claim 1, characterized in that, The fault events include: a first fault event requiring multiple maintenance personnel to work together to repair it; when the detected fault event is the first fault event, the designated maintenance personnel are multiple; The step of sending the access pass to the terminal device of the designated maintenance personnel includes: Send the corresponding access pass to the terminal device of each designated maintenance personnel. The access pass for each designated maintenance personnel includes: sub-access passes corresponding to multiple first access control nodes that the designated maintenance personnel need to pass through sequentially on their physical access path; the physical access path of the designated maintenance personnel is obtained by simulating the process of the designated maintenance personnel starting from the starting position and arriving at the faulty elevator. The verification of the pending information at the first access control node at the end of the core machine room where the faulty elevator is located is completed, including receiving a callback signal indicating that the pending information sent by all designated maintenance personnel through their respective terminal devices has been verified.

10. The method according to claim 1, characterized in that, After sending the access pass to the terminal device of the designated maintenance personnel, the method further includes: Receive a renewal request sent from the terminal device of the designated maintenance personnel; If the renewal request is initiated within the set validity period, the validity period of the pass is extended; In response to the situation where the renewal request is initiated after the set validity period, a new access pass is generated, a validity period is set for the new access pass, and the new access pass is sent to the terminal device of the designated maintenance personnel.

11. An emergency control device for a linked door lock, characterized in that, include: A memory and a processor, wherein the memory is configured to store an executable program; The processor is configured to read and execute the executable program to perform the emergency control method for the interlocking door lock as described in any one of claims 1-10.

12. A storage medium, characterized in that, The device contains a computer program, which, when executed by a processor, enables the emergency control method for the interlocking door lock as described in any one of claims 1-10.

Images