Processing a user request via a control system of a lift system and exchanging data between a mobile device and a control system of a lift system

Abstract

The invention relates to a method for processing a user request (7) via a control system (6) of a lift system (1), comprising: receiving the user request (7) in the control system (6); generating an identifier (15) that allows for clear identification of the user request (7), via the control system (6); transmitting the identifier (15) from the control system (6) to a mobile device (13) associated with the user request (7), wherein the mobile device (13) is configured to receive the identifier (15) from the control system (6) and to transmit an acknowledgement of receipt (16), that acknowledges receipt of the identifier (15) in the mobile device (13), to the control system (6) if the mobile device (13) receives a detection signal (12) that is sent by at least one transmitter (11) secured to a lift cabin (2) of the lift system (1); if the acknowledgement of receipt (16) is received in the control system (6); assigning the user request (7) to a first category; otherwise, assigning the user request (7) to a second category.

Description

[0001] Processing a user request by a control system of an elevator system and exchanging data between a mobile device and a control system of an elevator system

[0002] The present invention relates to a method for processing a user request by a control system of an elevator installation, as well as a control system for implementing this method. Furthermore, the invention relates to a method for exchanging data between a mobile device and a control system of an elevator installation, as well as a mobile device for implementing this method. Furthermore, the invention relates to a computer program and a computer-readable medium for executing one or both of the methods, as well as to a corresponding elevator installation.

[0003] Elevator cabins of elevator systems, such as those used to transport people or goods in multi-story buildings, are usually operated via control buttons that can be located in the cabin and / or in the building.

[0004] There are also contactless operating concepts in which a call can be transmitted contactlessly, i.e. via a wireless data communication link, via a mobile device connected to a central control unit, such as a smartphone or tablet. In this context, it is important to verify whether such a call was actually made by a user within the building in which the elevator system in question is installed, or to determine whether the call was generated, for example, by a hacker outside the building, which could potentially impair the operation of the elevator system. For this purpose, a QR code can be attached to each floor, for example, which allows the user's exact location to be determined. However, these codes can be copied with little effort.

[0005] There may therefore be a need for a method for processing a user request by a control system of an elevator installation that enables a reliable and technically simple distinction between genuine user requests generated by actual users of the elevator installation and potentially fake user requests. Furthermore, there may be a need for a corresponding control system, a corresponding method for exchanging data between the control system and a mobile device, a corresponding mobile device, a corresponding elevator installation, a corresponding computer program, and a corresponding computer-readable medium. These needs can be met by the subject matter of the independent claims. Advantageous embodiments are set forth in the dependent claims, the following description, and the accompanying figures.

[0006] A first aspect of the invention relates to a computer-implemented method for processing a user request by a control system of an elevator installation, wherein the elevator installation comprises at least one elevator car movable in an elevator shaft between different floors, and the elevator car comprises at least one transmitter for transmitting a detection signal, the method comprising: receiving the user request in the control system; generating an identifier that enables unique identification of the user request by the control system; sending the identifier from the control system to a mobile device associated with the user request, wherein the mobile device is configured to receive the identifier from the control system and to send a receipt confirmation that confirms receipt of the identifier in the mobile device to the control system when the mobile device receives the detection signal;If the acknowledgement of receipt is received in the control system: assigning the user request to a first category; otherwise: assigning the user request to a second category.

[0007] The process can be executed automatically by one or more processors of the control system.

[0008] The transmitter can be attached to the elevator car so that it can be moved along with the elevator car in the elevator shaft. The transmitter can be arranged inside and / or outside the elevator car. The detection signal can, for example, encode an ID of the transmitter. The transmitter can be configured to transmit the detection signal with a specific signal strength and / or at specific transmission intervals. In addition, the transmitter can be configured to receive signals, for example from the control system and / or the mobile device. If the elevator system comprises several elevator cars, each of the elevator cars can, for example, have at least one of its own transmitters. In addition, one such transmitter or several such transmitters can be arranged at locations other than the elevator cars, for example in the elevator shaft or in the area of ​​a door opening through which the elevator car is accessible from one of the floors.

[0009] In principle, user requests of different categories can differ in the way they are processed or handled by the control system. For example, the first category can include "desired," "permissible," or "genuine" user requests, whereas the second category can include "unsolicited," "prohibited," or "false" user requests.

[0010] The identifier can be, for example, a random code or a cookie.

[0011] The receipt confirmation can, for example, include the identifier itself. The receipt confirmation can be sent directly from the mobile device to the control system. Alternatively, the receipt confirmation can be sent from the mobile device to the control system via the transmitter.

[0012] The approach described above and below makes it possible to reliably identify and, if necessary, track unauthorized calls requesting an elevator car. In principle, the approach is based on the mobile device sending a call to the elevator control system via a wireless data communication connection being asked to verify its location, more precisely, to verify that it is within the elevator system, for example, within an elevator shaft and / or an elevator car. This verification should be provided within a defined time window and can, for example, be triggered automatically based on detection of the mobile device, such as when the user enters the elevator car and the mobile device carried by the user is within range of the elevator car's transmitter, i.e., can receive and process the detection signal.

[0013] This allows, for example, to distinguish between desired calls and unwanted calls. The latter can be continuously stored and updated in a corresponding list, allowing these calls to be tracked. This makes it possible, for example, to detect in a timely manner if a very large number of such calls are received, which could lead to an overload of the elevator system's data communication network and thus impair its proper operation. Appropriate countermeasures can then be taken in a timely manner, for example by at least temporarily deactivating and / or ignoring further user requests from the affected user or mobile device. Various escalation levels can be used for this purpose.

[0014] It is not mandatory to prevent all unwanted calls; in other words, some unwanted calls can be tolerated, at least temporarily, as long as the uninterrupted operation of the elevator system can be guaranteed. This can reduce the costs of implementing the procedure in hardware.

[0015] The advantage is that the data communication network for this type of user authentication does not need to cover the entire building, especially not all of the building's floors, but only requires the installation of suitable transmitters in a few selected sections of the building, namely the elevator cars. Typically, the number of elevator cars is significantly lower than the number of floors served by the elevator cars. This allows for significant reductions in installation costs compared to conventional concepts, which require very large-scale coverage.

[0016] A second aspect of the invention relates to a computer-implemented method for exchanging data between a mobile device and a control system of an elevator installation, wherein the elevator installation comprises at least one elevator car that can be moved in an elevator shaft between different floors and the elevator car comprises at least one transmitter for transmitting a detection signal, wherein the method comprises: generating a user request by the mobile device; sending the user request from the mobile device to the control system, wherein the control system is configured to receive the user request from the mobile device, generate an identifier that enables unique identification of the user request, and send the identifier to the mobile device associated with the user request; receiving the identifier in the mobile device;when the detection signal is received in the mobile device: sending an acknowledgment from the mobile device to the control system, confirming receipt of the identifier in the mobile device;

[0017] The control system may be configured to process the user request in a method for processing a user request as described above and below.

[0018] The process can be performed automatically by a processor of the mobile device.

[0019] The procedure enables secure identification of the mobile device as that of a user who is actually located at the location of the elevator system.

[0020] The mobile device can, for example, automatically generate the acknowledgment and / or send it to the control system. Alternatively, in response to receiving the detection signal, the mobile device can first automatically generate a prompt that prompts the mobile device user for input. The mobile device can then generate the acknowledgment in response to the user's input and / or send it to the control system. In this case, the acknowledgment can only be sent as a result of interaction with the (on-site) user. This further increases the security of the process.

[0021] A third aspect of the invention relates to a control system comprising a processor configured to execute the method described above and below for processing a user request by a control system of an elevator installation. Features of the control system can also be considered features of this method, and vice versa.

[0022] The control system can, for example, comprise a central server that can receive and process user requests from various mobile devices. For example, the server can be configured to forward the user requests to a local control device for controlling an actuator of the respective elevator system. The control device can also be part of the control system and can be connected to the server for data communication, for example, via the Internet.

[0023] It is possible for the server to communicate simultaneously with the control devices of different elevator systems at different locations.

[0024] For example, the server can generate control signals directly from user requests and forward them to the corresponding control device, which then implements the control signals accordingly.

[0025] Alternatively, the server can be configured to forward user requests to the appropriate control device. Forwarding can be done depending on the respective category of user requests. However, user requests can also be received directly by the control device, i.e., without going through the server.

[0026] The data communication between the server and the mobile device or devices can also take place via the Internet, for example. A fourth aspect of the invention relates to a mobile device comprising a processor configured to execute the method described above and below for exchanging data between a mobile device and a control system of an elevator installation. Features of the mobile device can also be considered features of this method, and vice versa.

[0027] A mobile device can be understood as a portable device with a processor, such as a smartphone, tablet, laptop, or smartwatch. The mobile device can run a special application that is executed by the mobile device's processor and enables the execution of the data exchange method described above and below.

[0028] The mobile device can be connected to the control system and / or the transmitter wirelessly, for example via WLAN, Bluetooth and / or mobile radio, and / or via the Internet for data communication.

[0029] The control system and the mobile device may each include hardware and / or software modules. In addition to the processor, the control system and the mobile device may each include a memory and data communication interfaces for data communication with peripheral devices.

[0030] A fifth aspect of the invention relates to an elevator system. The elevator system comprises: an elevator shaft; at least one elevator car that can be moved between different floors in the elevator shaft and includes at least one transmitter for transmitting a detection signal; the control system, as described above and below; and at least one mobile device, as described above and below.

[0031] Further aspects of the invention relate to a computer program and a computer-readable medium on which the computer program is stored.

[0032] The computer program comprises instructions which, when the computer program is executed by the processor, cause a processor to perform at least one of the methods described above and below.

[0033] The computer-readable medium may be a volatile or non-volatile data storage device. For example, the computer-readable medium may be a hard disk, a USB storage device, a RAM, ROM, EPROM, or flash memory. The computer-readable medium may also be a device that enables the download of program code.

[0034] Data communication network such as the Internet or a data cloud.

[0035] Features of the methods described above and below may also be considered as features of the computer program and / or the computer-readable medium and vice versa.

[0036] Without limiting the scope of the invention in any way, embodiments of the invention may be considered to be based on the ideas and findings described below.

[0037] According to one embodiment, the method for processing the user request may further comprise: storing the user request of the second category in a watchlist; if the watchlist exceeds a certain number of entries within a certain monitoring time, at least temporarily ignoring future user requests associated with the same mobile device as the entries in the watchlist. Thus, congestion of the data communication network in which the control system is connected to the mobile device(s) can be avoided without completely blocking unwanted user requests in the first place.

[0038] According to one embodiment, the user request can only be assigned to the first category if the acknowledgment of receipt is received within a specific waiting time starting at a specific point in time since the identifier was generated. This prevents the control system from continuously waiting for various acknowledgments, which can be associated with increased computational effort. Furthermore, the security of the method against unauthorized access can be increased. The waiting time can, for example, be less than 1 hour, in particular less than 10 minutes, preferably less than 1 minute.

[0039] According to one embodiment, the user request can include position data indicating a current location of the mobile device. To assign the user request, the position data can then additionally be evaluated. The position data can, for example, have been determined by a position sensor that can be part of the mobile device, for example using a global navigation satellite system such as GPS or GLONASS. It is possible for the position data to be compared with reference data that indicate possible plausible locations of the mobile device relative to the elevator system. If the position data indicate a plausible location, but no acknowledgment of receipt or the acknowledgment of receipt is not received in a timely manner, it can be concluded with a high degree of probability that the user request did not originate from an actual, i.e., on-site user of the elevator system.It is also conceivable that the user request is only recognized as originating from an actual user if the position data indicates a plausible location and the confirmation of receipt is received (in a timely manner). The position data can therefore be used to verify the plausibility of the user request when categorizing it. This can further increase the reliability of the process.

[0040] According to one embodiment, the method for processing the user request may further comprise: generating a control signal for controlling an actuator of the elevator system based on the user request, so that the elevator car is moved from a starting floor to a destination floor, wherein the user request defines the starting floor and / or the destination floor. For example, the user can select the starting floor and / or the destination floor in an application running on their mobile device (see also above). The user request generated by this application can then contain corresponding information about the selected starting or destination floor. This embodiment enables the implementation of contactless control of the elevator system via the mobile device.

[0041] If the elevator installation comprises a plurality of elevator cars, the method may further comprise a step of selecting an elevator car from the plurality of elevator cars, wherein the control signal may be generated in order to move the selected elevator car from its current position to the starting floor and / or from the starting floor to the destination floor.

[0042] It is possible that the control signal is generated before the time at which the system begins waiting for the acknowledgment. This allows the elevator car to be moved to the desired destination floor even before the acknowledgment is received.

[0043] According to one embodiment, the transmitter can be configured to transmit the detection signal within a defined range of no more than 10 m, preferably no more than 1 m. This ensures that the mobile device only receives the detection signal when it is in the elevator car or in the immediate vicinity of the elevator car.

[0044] According to one embodiment, the transmitter can be a Bluetooth transmitter, an RFID transmitter, or an ultra-wideband transmitter. Such a transmitter can be provided particularly cost-effectively and is easy to install.

[0045] Advantageous embodiments of the invention are further explained below with reference to the accompanying drawings, wherein neither the drawings nor the explanations are to be interpreted as limiting the invention in any way.

[0046] Fig. 1 shows an elevator system according to an embodiment of the invention.

[0047] Fig. 2 shows a flowchart of a method according to an embodiment of the invention.

[0048] The figures are merely schematic and not to scale. The same reference numerals designate the same or equivalent features in the various drawings.

[0049] Fig. 1 shows an elevator system 1 with an elevator shaft 2 in which an elevator car 3 can be moved between several floors 4 by means of an actuator 5. The actuator 5, which may comprise an electric motor, is controllable by a control system 6 configured to process a user request 7.

[0050] The method can be executed by a processor 8 of the control system 6, wherein the processor 8 can be part of a central server 9 and / or a control device 10 of the control system 6.

[0051] The control device 10 can, for example, be part of the same elevator installation 1 as the actuator system 5, whereas the server 9 can be connected to the control devices 10 of different elevator installations 1 at different locations for data communication, for example via the Internet.

[0052] A transmitter 11 is attached to the elevator car 3, here inside the elevator car 3. The transmitter 11 is movable along with the elevator car 3 in the elevator shaft 2 and is configured to emit a detection signal 12. The elevator car 3 can also comprise several transmitters 11, which can be attached at different locations on the elevator car 3.

[0053] The transmitter 11 can transmit the detection signal 12, for example, with a specific signal strength which is defined such that the detection signal 12 can be received by a mobile device 13, such as a smartphone or tablet, within a radius of at most 10 m, preferably of at most 1 m, around the transmitter 11.

[0054] The transmitter 11 can be designed, for example, as a Bluetooth, RFID or ultra-wideband transmitter or as a combination of at least two of these examples.

[0055] The user request 7 is normally generated by a mobile device 13, which is carried by a user 14 of the elevator system 1 and on which a special application for contactless control of the elevator system 1 can run. The application can be executed by a processor 8 of the mobile device 13. The user 14 who wishes to use the elevator system 1 is normally located in the immediate vicinity of the elevator system 1. In some cases, however, the user request 7 can be misused and generated by a remote, third-party device, for example, as part of a hacker attack or similar. To distinguish such unwanted user requests from genuine user requests, the method described below can be carried out (see Fig. 2), in which the processor 8 of the mobile device 13 or the control system 6 executes a corresponding computer program.

[0056] Here, the mobile device 13 generates the user request 7 in a step SO1 and sends it to the control system 6 in a step SO2.

[0057] For example, user request 7 can indicate a destination floor 4a desired by user 14. Additionally, user request 7 can indicate a starting floor 4b on which user 14 is currently located or from which user 14 wishes to be taken to the destination floor 4b.

[0058] The user request 7 may also include an address from which the user request 7 was sent in a data communication network in which the mobile device 13 and the control system 6 are networked with each other, such as the Internet.

[0059] In addition, the user request 7 can include position data indicating a current location of the mobile device 13. The position data can be, for example, geographical coordinates of the mobile device 13. In a step S03, the control system 6 receives the user request 7 from the mobile device 13. The user request 7 can be received by the server 9 and / or by the control device 10.

[0060] In a step S04, the control system 6 generates an identifier 15 for the user request 7. The identifier 15 enables a unique identification of the user request 7, ie a unique differentiation of the user request 7 from any other user requests received in the control system 6.

[0061] In a step S05, the control system 6 sends the identifier 15 back to the mobile device 13 associated with the user request 7.

[0062] In a step S06, the mobile device 13 receives the identifier 15 from the control system 6. The identifier 15 can be stored locally in the mobile device 13.

[0063] If the mobile device 13 is within range of the transmitter 11, for example, because the user 14 carrying the mobile device 13 has entered the elevator car 3, the mobile device 13 can receive the detection signal 12 in a step S07. Only then does the mobile device 13 send a receipt acknowledgment 16, which confirms receipt of the identifier 15 in the mobile device 13, back to the control system 6.

[0064] In a step S08, the control system 6 receives the receipt acknowledgment 16 from the mobile device 13.

[0065] In a step S09, the control system 6 assigns the user request 7 to a specific first category in response to the (timely) receipt of the confirmation of receipt 16, here for example the category “allowed user request”.

[0066] If the control system 6 had not received an acknowledgment of receipt 16 regarding the user request 7, for example because the mobile device 13 assigned to the user request 7 is not in the immediate vicinity of the transmitter 11, in particular not in the elevator car 3, the control system 6 would have assigned the user request 7 to a specific second category in step S09, here for example the category “unauthorized user request”.

[0067] It is expedient that user request 7 is only assigned to the first

[0068] Category if the receipt 16 is received within a limited

[0069] Waiting time is received from a specific point in time since the generation of the identifier 15 in step S04. The waiting time can, for example, be a maximum of 1 hour, in particular a maximum of 10 minutes, preferably a maximum of 1 minute.

[0070] To assign user request 7 in step S09, the position data can also be evaluated.

[0071] If the user request 7 is categorized as an “unauthorized user request,” the control system 6 may store the user request 7 in a monitoring list in an additional step S10.

[0072] If the monitoring list exceeds a certain number of entries, for example, 10, 100, or 1000, within a certain monitoring time, for example, 1 hour, 10 minutes, 1 minute, or 1 second, the control system 6 can, in an additional step S11, at least temporarily ignore further user requests assigned to the same address or the same mobile device 13 as the entries in the monitoring list. Thus, overloads of the data communication network of the elevator installation 1, for example, between the server 9 and the control device 10, between the server 9 and the mobile device 13 (or mobile devices 13), or between the control device 10 and the mobile device 13 (or mobile devices 13), can be avoided.

[0073] In a step S12, which can be executed before step S09, the control system 6 can additionally generate a control signal 17 based on the user request 7, which is used to control the actuator system 5 such that the elevator car 3 travels from the starting floor 4b to the destination floor 4a. Thus, the receipt confirmation 16 can only be sent by the mobile device 13 or received in the control system 6 during the journey.

[0074] Below, an example of the procedure is summarized again in other words.

[0075] 1) The user 14 opens the application (registered with a specific unique ID) on his mobile device 13 and makes a destination call, whereby a corresponding user request 7 is generated and sent.

[0076] 2) A cloud application running on server 9 grants the destination call and returns a positive confirmation along with the identifier 15 that uniquely identifies the destination call. 3) Server 9 notifies control device 10 to execute the destination call and assign the identifier 15 to the elevator car 3 selected for the destination call (or to all elevator cars 3 if the elevator car 3 designated for the destination call is dynamically selected on-site).

[0077] 4) The selected elevator car 3 stops at the exit floor 4b and the user 14 gets on.

[0078] 5) During the journey to the destination floor 4a, the transmitter 11 of the elevator car 3 requests the mobile device 13 (carried by the user 14) to send the confirmation of receipt 16 to the control system 6.

[0079] 6) If the identifier 15 contained in the acknowledgement 16 is correct, the destination call is recognized as valid.

[0080] 7) If the request remains unanswered, the target call is marked as potentially invalid.

[0081] The server 9 can inform the control device 10 about potentially invalid destination calls and vice versa.

[0082] When a certain number of potentially invalid target calls per unit of time originating from the same mobile device 13 is reached, the control device 10 can inform the server 9 (or vice versa) so that corresponding user requests 7 from the mobile device 13 in question are temporarily deactivated.

[0083] Finally, it should be noted that terms such as "having," "comprising," etc., do not exclude other elements or steps, and indefinite articles such as "a" or "an" do not exclude a plurality. Furthermore, it should be noted that features or steps described with reference to one of the above embodiments may also be used in combination with features or steps described with reference to other of the above embodiments. Reference signs in the claims are not to be considered as limitations.

Claims

Claims 1. Method for processing a user request (7) by a control system (6) of an elevator system (1), wherein the elevator system (1) comprises at least one elevator car (3) movable in an elevator shaft (2) between different floors (4, 4a, 4b) and the elevator car (3) comprises at least one transmitter (11) for sending a detection signal (12), wherein the method comprises: Receiving the user request (7) in the control system (6); Generating an identifier (15) that enables the control system (6) to uniquely identify the user request (7); Sending the identifier (15) from the control system (6) to a mobile device (13) associated with the user request (7), the mobile device (13) being configured to receive the identifier (15) from the control system (6) and to send an acknowledgment (16) confirming receipt of the identifier (15) in the mobile device (13) to the control system (6) when the mobile device (13) receives the detection signal (12); when the acknowledgment (16) is received in the control system (6): Assign the user request (7) to a first category; otherwise: assign the user request (7) to a second category.

2. The method of claim 1, further comprising: Storing the user request (7) of the second category in a watchlist; if the watchlist exceeds a certain number of entries within a certain watch period: At least temporarily ignoring future user requests (7) that are associated with the same mobile device (13) as the entries in the watchlist.

3. Method according to one of the preceding claims, wherein the user request (7) is assigned to the first category only if the acknowledgment of receipt (16) is received within a certain waiting period from a certain time since the generation of the identifier (15).

4. Method according to one of the preceding claims, wherein the user request (7) includes location data indicating a current location of the mobile device (13); wherein the location data is additionally evaluated to assign the user request (7). Method according to any of the preceding claims, further comprising: Generating a control signal (17) to control an actuator (5) of the elevator system (1) based on the user request (7), such that the elevator car (3) moves from an originating floor (4b) to a destination floor (4a), wherein the user request (7) defines the originating floor (4b) and / or the destination floor (4a). A method for exchanging data (7, 15, 16) between a mobile device (13) and a control system (6) of an elevator system (1), wherein the elevator system (1) comprises at least one elevator car (3) movable in an elevator shaft (2) between different floors (4, 4a, 4b) and the elevator car (3) comprises at least one transmitter (11) for sending a detection signal (12), wherein the method comprises: Generating a user request (7) by the mobile device (13); Sending the user request (7) from the mobile device (13) to the control system (6), wherein the control system (6) is configured to receive the user request (7) from the mobile device (13), to generate an identifier (15) that enables unique identification of the user request (7), and to send the identifier (15) to the mobile device (13) associated with the user request (7); Receiving the identifier (15) in the mobile device (13); when the detection signal (12) is received in the mobile device (13): sending an acknowledgment (16) confirming the receipt of the identifier (15) in the mobile device (13) from the mobile device (13) to the control system (6). Control system (6), comprising a processor (8) configured to execute the method according to any one of claims 1 to 5. Mobile device (13), comprising a processor (8) configured to execute the method according to claim 6. Elevator system (1), comprising: an elevator shaft (2); at least one elevator car (3) movable in the elevator shaft (2) between different floors (4, 4a, 4b) and comprising at least one transmitter (11) for sending a detection signal (12); the control system (6) according to claim 7; and at least one mobile device (13) according to claim 8.

10. Elevator system (1) according to claim 9, wherein the transmitter (11) is configured to transmit the detection signal (12) within a defined range of at most 10 m, preferably at most 1 m.

11. Elevator system (1) according to claim 9 or 10, wherein the transmitter (11) is a Bluetooth transmitter, an RFID transmitter, or an ultra-wideband transmitter.

12. Computer program comprising instructions that cause a processor (8), when the computer program is executed by the processor (8), to execute the method according to any one of claims 1 to 5, the method according to claim 6 or both methods.

13. Computer-readable medium on which the computer program according to claim 12 is stored.

Images