Elevator system

Abstract

A method of controlling operation of an elevator system (2), the elevator system (2) including a hoistway (4) extending between a plurality of landings (8) situated on different floors (9), and at least one elevator car (6) configured for moving along the hoistway (4) between the plurality of landings (8). The method includes receiving a control input indicating a passenger transport request, wherein the control input comprises at least one passenger transport request parameter; monitoring passengers (30) within or outside the elevator car (6) and determining at least one passenger parameter associated with the passengers (30); comparing the at least one passenger transport request parameter with the at least one passenger parameter; and controlling further operation of the elevator system (2) based on the result of said comparison.

Claims

1. Method of controlling operation of an elevator system (2) comprising: a hoistway (4) extending between a plurality of landings (8) situated on different floors (9); and at least one elevator car (6) configured for moving along the hoistway (4) between the plurality of landings (8); wherein the method includes: receiving a control input indicating a passenger transport request, the control input comprising at least one passenger transport request parameter; monitoring passengers (30) within or outside the elevator car (6) and determining at least one passenger parameter associated with the passengers (30); comparing the at least one passenger transport request parameter with the at least one passenger parameter; and controlling further operation of the elevator system (2) based on the result of said comparison; wherein controlling further operation of the elevator system (2) includes ignoring the received control input if the at least one passenger transport request parameter does not coincide with the at least one passenger parameter.

2. Method according to claim 1, wherein the method further includes determining the reliability of the determined passenger parameter and controlling further operation of the elevator system (2) based on the result of the comparison only if the determined reliability exceeds a predetermined threshold.

3. Method according to claim 1, wherein controlling further operation of the elevator system (2) includes operating the elevator system (2) according to the received control input if the at least one passenger transport request parameter coincides with the at least one passenger parameter.

4. Method according to claim 1, wherein controlling further operation of the elevator system (2) includes issuing an alarm if the at least one passenger transport request parameter does not coincide with the at least one passenger parameter.

5. Method according to claim 1, wherein the at least one passenger transport request parameter and the at least one passenger parameter include a cardinality of a group of passengers (30) associated and/or a volume occupancy of at least one passenger (30) with the respective control input.

6. Method of controlling operation of an elevator system (2) comprising: a hoistway (4) extending between a plurality of landings (8) situated on different floors (9); and at least one elevator car (6) configured for moving along the hoistway (4) between the plurality of landings (8); wherein the method includes: receiving a control input indicating a passenger transport request, the control input comprising at least one passenger transport request parameter; monitoring passengers (30) within or outside the elevator car (6) and determining at least one passenger parameter associated with the passengers (30); comparing the at least one passenger transport request parameter with the at least one passenger parameter; and controlling further operation of the elevator system (2) based on the result of said comparison; wherein the method includes identifying at least one individual passenger (30) and checking whether all identified passengers (30) associated with a control input have boarded the elevator car (6).

7. Method of controlling operation of an elevator system (2) comprising: a hoistway (4) extending between a plurality of landings (8) situated on different floors (9); and at least one elevator car (6) configured for moving along the hoistway (4) between the plurality of landings (8); wherein the method includes: receiving a control input indicating a passenger transport request, the control input comprising at least one passenger transport request parameter; monitoring passengers (30) within or outside the elevator car (6) and determining at least one passenger parameter associated with the passengers (30); comparing the at least one passenger transport request parameter with the at least one passenger parameter; and controlling further operation of the elevator system (2) based on the result of said comparison; wherein the method includes identifying at least one individual passenger (30) and checking whether any identified passenger (30) entered more than one control input indicating a passenger transport request.

8. Method according to claim 1, wherein the method includes identifying at least one individual passenger (30) and checking whether the at least one identified passenger (30) leaves the elevator car (6) at a landing (8) corresponding with the control input associated with said passenger (30).

9. Method according to claim 1, wherein the method includes identifying all passengers (30) boarding the elevator car (6) and checking whether all passengers (30) within the elevator car (6) are associated with a control input, respectively.

10. Method according to claim 6, wherein identifying at least one individual passenger (30) includes identifying said at least one individual passenger (30) by body analysis and/or by face recognition; wherein identifying the at least one individual passenger (30) in particular includes applying machine learning methods.

11. Elevator system (2) comprising: a hoistway (4) extending between a plurality of landings (8) situated on different floors (9); an elevator car (6) configured for moving along the hoistway (4) between the plurality of landings (8); an elevator drive (5) configured for moving the elevator car (6) along the hoistway (4); and an elevator control (24) configured for controlling operation of the elevator system (2) by controlling the elevator drive (5); wherein the elevator control (24) is configured for controlling operation of the elevator system (2) by applying a method according to claim 1.

12. Elevator system (2) according to claim 11 further comprising at least one sensor (20), in particular a camera, which is configured for monitoring the passengers (30) within and/or outside the elevator car (6).

13. Elevator system (2) according to claim 12, wherein the at least one sensor (20) is located within the elevator car (6), at one of the landings (8) outside the elevator car (6), and/or in a control kiosk (22) arranged on one of the floors (9).

14. Elevator system (2) according to claim 11, further comprising at least one safety door (36) at at least one of the landings (8) which may be closed in order to prevent unauthorized passengers (30) from entering the respective floor (9).

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) In the following, an exemplary embodiment of the invention are described in more detail with respect to the enclosed figures:

(2) FIG. 1 schematically depicts an elevator system according to an exemplary embodiment of the invention.

(3) FIG. 2 depicts a flow chart of a method of controlling operation of an elevator system according to an embodiment of the invention.

(4) FIG. 3 depicts a flow chart of a method of controlling operation of an elevator system according to another embodiment of the invention.

(5) FIG. 4 depicts a flow chart of a method of controlling operation of an elevator system, wherein the elevator system used for access control.

DETAILED DESCRIPTION OF THE INVENTION

(6) FIG. 1 schematically depicts an elevator system 2 according to an exemplary embodiment of the invention.

(7) Exemplary embodiments of two similar but different methods of controlling the operation of the elevator system 2 are described with reference to the flow-charts depicted in FIGS. 2 and 3.

(8) The elevator system 2 includes an elevator car 6 which is movably arranged within a hoistway 4 extending between a plurality of landings 8 located on different floors 9. The elevator car 6 in particular is movable in a longitudinal (vertical) direction along a plurality of car guide members 14, such as guide rails, extending along the vertical direction of the hoistway 4. Only one of said car guide members 14 is depicted in FIG. 1.

(9) Although only one elevator car 6 is shown in FIG. 1, the skilled person understands that exemplary embodiments of the invention may include elevator systems 2 including a plurality of elevator cars 6 moving in one or more hoistways 4.

(10) The elevator car 6 is movably suspended by means of a driving member (tension member) 3. The driving member 3, for example a rope or belt, is connected to an elevator drive 5, which is configured for driving the driving member 3 in order to move the elevator car 6 along the height of the hoistway 4.

(11) Details of the roping configuration are not specified in FIG. 1. The skilled person understands that the type of the roping is not essential for the invention and that different kinds of roping, such as a 1:1 roping, a 2:1 roping or a 4:1 roping may be employed.

(12) The driving member 3 may be a rope, e.g. a steel wire rope, or a belt. The driving member 3 may be uncoated or may have a coating, e.g. in the form of a polymer jacket. In a particular embodiment, the driving member 3 may be a belt comprising a plurality of polymer coated steel cords (not shown). The elevator system 2 may have a traction drive including a traction sheave for driving the driving member 3. In an alternative configuration, which is not shown in the figures, the elevator system 2 may be an elevator system 2 without a driving member 3.

(13) The elevator system 2 also may comprise e.g. a hydraulic drive or a linear drive in place of the driving member 3. The elevator system 2 may have a machine room (not shown) or it may be a machine room-less elevator system 2.

(14) The elevator system 2 further includes a counterweight 19 attached to the driving member 3 and configured for moving concurrently and in opposite direction with respect to the elevator car 6 along at least one counterweight guide member 15. The skilled person will understand that the invention may be applied also to elevator systems 2 which do not comprise a counterweight 19.

(15) Each landing 8 is provided with a landing door 11. The elevator car 6 is provided with a corresponding elevator car door 12 for allowing passengers to transfer between a landing 8 and the interior of the elevator car 6 when the elevator car 6 is positioned at the respective landing 8.

(16) The elevator drive 5 is controlled by an elevator control 24 for moving the elevator car 6 along the hoistway 4 between the different landings 8.

(17) Input to the elevator control 24 may be provided via landing control panels 7a provided on each of the landings 8, and/or via an elevator car control panel 7b provided inside the elevator car 6. Additionally or alternatively, input to the elevator control may be input using mobile phones (smart-phones) 10 carried by the passengers 30 and running an appropriate software. Mobile phones 10 may communicate directly with the controller 24 through a short range wireless data connection, such as WLAN or Bluetooth, or through a communications network (local and/or remote), or a combination thereof.

(18) The landing control panels 7a and the elevator car control panel 7b may be connected to the elevator control 24 by means of electric wires, which are not shown in FIG. 1, in particular by an electric bus, or by means of wireless data connections.

(19) The landing control panels 7a may be arranged at a wall 26 next to the respective landing door 11. Additionally or alternatively, landing control panels 7a may be located in control kiosks 22 provided on the respective floors 9. The control kiosks 22 may be arranged close to the respective landing doors 11. The control kiosks 22 also may be arranged in some distance from the landing doors 11, in particular if there are different elevator blocks within the building, in order to allow passengers 30 to enter their respective control inputs before reaching the respective landing 8.

(20) The elevator system 2, in particular the elevator control 24, may be configured for controlling the movement of the elevator car applying destination dispatching. When destination dispatching is applied, the landing control panels 7a are configured for receiving control inputs including destination requests indicating the destination(s) of the passenger(s) 30 associated with the respective control input. The elevator control 24 is configured for assigning each passenger 30, who has entered a destination request, to an elevator car 6 serving the passenger's destination. Destination dispatching allows distributing the passengers 30 over a plurality of elevator cars 6 so that the transport capacity of the elevator system 2 is optimized. The communication between the passengers 30 and the elevator system 2 can be handled either via the landing/car control panels 7a, 7b or the control kiosks 22. Alternatively or additionally, it may relay on integration of the passengers' own devices such as mobile phones 10 and similar devices. Connectivity between the elevator system 2 and the mobile devices 10 may be based on Wi-Fi-connections, Bluetooth-connections and/or NFC sensors.

(21) In a method of controlling the elevator system (see FIGS. 2 and 3), a control input from the passenger(s) is received in a step 100 via the landing control panels 7a or a mobile device 10. As mentioned before, the control input comprises information about the destination of the passenger(s) 30 associated with the control input.

(22) The control input may include further information associated with the passengers. Said information may, for example, include the size of a group of passengers 30 intending to travel together in the same elevator car 6 (cardinality) and/or increased volume requirements of the passenger(s) 30. Such increased volume requirements may result from passengers 30 using wheelchairs or traveling with extensive luggage 31. Said extensive luggage 31 may include bicycles, prams, buggies, and the like.

(23) The elevator system 2 further comprises sensors 20, which are configured for detecting the passengers 30 of the elevator system 2. The sensors 20 may be arranged within the elevator car 6 and/or outside the elevator car 6, in particular at or close to one of the landing doors 11.

(24) Sensors 20 configured for detecting passengers 30 also may be located at or within the control kiosks 22 provided on the floors 9.

(25) The sensors 20 may include cameras, which are configured for optically detecting passengers 30 and their luggage 31 including wheelchairs etc. within our outside the elevator car 6. Alternatively or additionally, the sensors 20 may include depth sensors, floor pressure sensors, radar sensors, IR sensors or other sensors, which are capable to detect the passengers 30 and their luggage 31.

(26) A monitoring circuit 28 is provided as part of or separately from the elevator control 24. The monitoring circuit 28 may be provided locally or within a virtual cloud. The monitoring circuit 28 is configured for receiving signals from the sensors 20 and for determining (in step 200 depicted in FIGS. 2 and 3) from the received signals at least one passenger parameter associated with the detected passenger(s) 30.

(27) Said passenger parameter may include the cardinality (size) of a group of passengers 30 gathering at a landing 8 for traveling together in a single elevator car 6. Alternatively or additionally, the passenger parameter may include volume requirements of the passengers 30, i.e. volume requirements which are larger than the typical volume requirements of passengers 30 of an elevator system 2.

(28) Additionally or alternatively, the monitoring circuit 28 may be configured for recognizing and/or identifying individual passengers 30 based on the signals received from the sensors 20, for example by applying methods of face recognition and/or gait recognition. This also may include applying machine learning methods.

(29) When a passenger 30 has been identified, the control input entered by the respective passenger 30 is associated with said passenger 30, i.e. the passenger 30 and the associated control input are linked with each other.

(30) The monitoring circuit 28 may be configured for checking whether any identified passenger 30 input more than one control input indicating a passenger transport request. Identifying and ignoring multiple control inputs from the same passenger 30 allows enhancing the efficiency and the capacity of the elevator system 2 by preventing unnecessary stops of the at least one elevator car 6 caused by multiple control inputs from the same passenger 30.

(31) The monitoring circuit 28 may further be configured for identifying repeated calls to the same destination, which have been entered by the same passenger 30 in order to achieve an empty elevator car 6 or a faster service. Identifying and ignoring repeated calls to the same destination input by the same passenger 30 allows enhancing the efficiency and the capacity of the elevator system 2 by preventing an inefficient scheduling of the elevator car(s) 6 caused by multiple control inputs from the same passenger 30.

(32) The elevator system 2 further comprises a comparator 32, which is configured for comparing the parameter(s) associated with a control input with corresponding parameter(s) determined by the monitoring circuit 28 from the signals received from at least one of the sensors 20. This is done in step 400 shown in FIGS. 2 and 3. (Steps 300 to 350 depicted in FIGS. 2 and 3 will be discussed further below.)

(33) In case the parameter(s) associated with a control input correspond, within a given tolerance, with the corresponding parameter(s) detected and/or determined by the monitoring circuit 28, the elevator control 24 proceeds with operating the elevator system 2 in accordance with the received control input. This is illustrated as step 500 in FIGS. 2 and 3.

(34) In case, however, at least one of the parameter(s) associated with a control input considerably differs by more than the given tolerance from the corresponding parameter detected and/or determined by the monitoring circuit 28, the elevator control 24 will deviate from normal operation in order to react to the detected deviation (step 600 in FIGS. 2 and 3).

(35) For example, a control input, which was input via one of the control panels 7a, 7b, may be ignored if at least one of the parameters associated with said control input differs by more than a predetermined threshold from the corresponding parameter detected and/or determined by the monitoring circuit 28.

(36) A control input in particular may be ignored if the difference between a cardinality of a group of passengers 30 intending to travel in the same elevator car 6, which was entered together with the control input, and the cardinality of said group of passengers 30, as it has been detected and/or determined by the monitoring circuit 28 from signals received from at least one of the sensors 20, is larger than a given threshold. By ignoring said control input, inefficient operation, which would be caused by the erroneous control input, may be prevented.

(37) The threshold may be set as an absolute value, e.g. as number of passengers 30 of a group or the absolute space given in m2, m3, ft2, or ft3, needed for extra luggage. The threshold, for example, may correspond to a deviation of one, two, three or more passengers. Alternatively, the threshold may be set as a percentage of the input parameter. I.e., the threshold may correspond to a deviation of 10%. 20%. 30%, 40%, 50% or more percent of the space requested with the respective control input.

(38) The threshold may depend on different parameters, like the impact on time, the type of building and its use, i.e. whether it is a commercial building, an office building or a residential building. The threshold therefore may be adjusted individually to the respective building.

(39) For example, if a passenger 30 states that he is traveling with a group of seven people, but only four passengers 30 are detected at the respective landing 8, such a discrepancy of about 40% may be ignored during off-peak hours. However, during peak-hours, such as in the morning and/or in the evening, when many people use the elevator system 2 simultaneously, any discrepancy of more than 20% will not be ignored, but the control input causing such a discrepancy will be ignored or adjusted to the detected size of the group of passengers 30.

(40) Similarly, in case an increased volume occupancy of one or more passengers 30 is not confirmed by the monitoring circuit 28, a request to satisfy the demand for such an increased volume occupancy may be ignored. By ignoring an unconfirmed demand for an increased volume occupancy, an unnecessary low occupancy of an elevator car 6 due to a falsely requested demand for an increased volume may be avoided. As a result, the elevator system 2 may be operated more efficiently.

(41) Further, any passenger 30 entering a control input indicating a desired destination floor 9 via a landing control panel 7a may be identified. After the elevator car 6 assigned to the respective passenger 30 by the dispatching algorithm has arrived at the passenger's floor 9, the monitoring circuit 28 may check whether the passenger 30, who has entered the control input, boards the elevator car 6. In case it is determined that the passenger 30 did not board the elevator car 6 and/or left the landing 8, the passenger's control input may be ignored. This avoids unnecessary stops of the elevator car 6 at destination floors 9 input by passengers 30 which did not board the elevator car 6. Avoiding unnecessary stops of the elevator car 6 enhances the efficiency of the elevator system 2 and improves the travel experience of the other passengers 30.

(42) Alternatively or additionally, the monitoring circuit 28 may check whether as single passenger 30 entered more than one control input. In case more than one control input has been entered by the same passenger 30, the elevator control 24 may be configured for ignoring all control inputs entered by said passenger 30 except for the control input entered last. Again, the efficiency of the elevator system 2 is enhanced since unnecessary stops of the elevator car 6 are avoided by ignoring multiple destinations entered by the same passenger 30. It also prevents gaming from multiple calls entered by the same passenger 30 to the same floor 9.

(43) In order to enhance the operational reliability of the elevator system 2, the monitoring circuit 28 may be configured for determining a reliability value indicating the reliability of the determined passenger parameter.

(44) In such a configuration, the monitoring circuit 28 predicts a value, such as a cardinality of a group of passengers 30, a volume of the space occupied by a passenger 30 and his luggage 31, a logic (yes or no) value indicating whether the same passenger 30 called the same elevator car 6 several times, etc., with a certain probability. For example, the monitoring circuit 28 may predict that a passenger 30 requesting extra space for a wheelchair does not need said extra space since he does not use a wheelchair with a reliability value indicating a probability of 90%. A reliability value indicating a probability of 90% indicates that, based on the currently available information, in 9 out of 10 occasions the passenger 30 does not need the requested extra space.

(45) This is illustrated as step 300 in FIGS. 2 and 3. The monitoring circuit 28 further may be configured for comparing the determined reliability value with a predefined threshold (step 310 in FIGS. 2 and 3) in order to modify the operation of the elevator system 2 based on the determined passenger parameter (in step 600) only in case the determined reliability value of said passenger parameter exceeds the predefined threshold.

(46) In case the determined reliability value does not exceed the predefined threshold, the control input provided by the passenger 30 is trusted and the elevator system 2 is controlled (in step 500) according to said control input.

(47) Due to the restricted space, determining passenger parameters of passengers 30 within the elevator car 6 is often easier and more reliable than determining passenger parameters of passengers 30 outside the elevator car 6.

(48) Thus, according to an exemplary embodiment of the invention which is illustrated in FIG. 3, in a first step (step 300 in FIG. 3), the at least one passenger parameter and its reliability are determined when the passenger(s) 30 are still outside the elevator car 6, e.g. at one of the landings 8 (landing algorithm).

(49) It is checked, whether the determined passenger parameter(s) deviate from the corresponding parameter input by the passenger(s) (step 400), and if the reliability value(s) of the results of the landing algorithm exceed the predefined threshold, the control of the elevator system 2 is modified according to the determined passenger parameter(s) (step 600 in FIG. 3) in case a sufficiently large deviation is detected.

(50) If the reliability value(s) of the results of the landing algorithm do not exceed the predefined threshold, the passenger parameter(s) and the corresponding reliability values are determined again based on signals received from sensors 20 within the elevator car 6 (car algorithm) after the passenger(s) 30 associated with the respective control input boarded the elevator car 6 (step 320 in FIG. 3).

(51) In step 330 it is checked whether the reliability value(s) determined from the car algorithm exceed the predefined threshold.

(52) If the reliability value(s) determined from the car algorithm exceed the predefined threshold, the method proceeds with step 400, as it has been described before, using the passenger parameter(s) determined by the car algorithm instead of the passenger parameter(s) determined by the landing algorithm.

(53) Due to the increased reliability of the car algorithm, step 330 of checking whether the reliability value(s) determined from the car algorithm exceed the predefined threshold is optional. If the reliability of the results provided by the car algorithm is considered to be always sufficient, step 330 may be omitted and the method may proceed directly with step 400.

(54) The results achieved by the car algorithm also may be used for improving the landing algorithm, e.g. by methods including machine learning (step 350 in FIG. 3).

(55) A machine learning algorithm learns from a so called training set (e.g. pairs image/number of people in the image), and applies the result of said learning process to new data, for example to a new image, by stating the number of people in the image. Any time an external entity, such as a person or more reliable algorithm, tells the machine learning algorithm whether its prediction was correct or not, and in case it is not what was the correct answer, this new pair of image and the correct answer, becomes part of the training set, thereby enlarging the training set. The machine learning algorithm can then re-train itself based on this new training dataset, in order to become more precise. The step of re-training can be repeated many times in order to enhance the quality and the reliability of the results provided by the algorithm.

(56) Again, similar to the method illustrated in FIG. 2, the passenger parameter(s) 30 determined by the car algorithm are ignored and the elevator system is controlled based on the control input provided by the passenger(s) 30 (step 500), if the reliability value(s) determined from the car algorithm does not exceed the predefined threshold.

(57) An elevator system 2 comprising an elevator control 24 in accordance with an exemplary embodiment of the invention also may be used for controlling access of the passengers 30 to the different floors 9.

(58) FIG. 4 depicts an exemplary flow chart of a method of controlling operation of an elevator system 2, in which the elevator system 2 is employed as an access control system.

(59) In order to be used for access control, the elevator control 24 comprises, or has access to, a database 34 (see FIG. 1), in which information about previously identified passengers 30 is stored.

(60) The database 34 may be integrated as part of the IT infrastructure of the building housing the elevator system 2 to be administered under the responsibility of building owner. Such a database may be coupled to external remote services, such as cloud services, as far as the passenger's privacy is properly handled. The database 34 contains digital anonymous identities of known passengers 30. An identity for example includes: (1) a set of anonymous and numerical features corresponding to the identity of the respective passenger 30, i.e. embedding. These features cannot be reversed for obtaining any relevant personal data. (2) a log file of the journeys of the respective passenger 30 comprising a timestamp, the departure floor 9 and the destination floor 9 of the respective journey. Classically, features are extracted by means of facial recognition or behavioral analysis, see e.g. Vezzani, Roberto, Davide Baltieri, and Rita Cucchiara. People reidentification in surveillance and forensics: A survey. ACM Computing Surveys (CSUR) 46.2 (2013): 29.

(61) When a passenger 30 approaches one of the landings 8 of the elevator system 2, the passenger 30 is detected by at least one of the sensors 20 in step 810 shown in FIG. 4, and the database 34 is queried in step 820 for an entry corresponding to the information about said passenger 30 derived from the signals provided from the sensors 30. Alternatively or additionally, the passenger 30 may be identified based on data received from a device, such as a smart phone 10 or an RFID chip, carried by the respective passenger 30.

(62) If an entry corresponding to the passenger 30 is found within the database 34, the passenger 30 is welcomed and a control input, which is based on the information stored within the database, is generated (step 830). Said information in particular may include the usual destination of the identified passenger 30.

(63) Optionally, the passenger 30 may be allowed to change the control input, in particular his destination, e.g. via a landing control panel 7a. In case the passenger 30 is not allowed to access all floors 9, only the allowed floors 9 may be offered as potential destinations to the passenger 30.

(64) In case no entry matching the passenger 30 is found within the database 34, the passenger 30 may be invited to identify/authorize himself and to enter his desired destination (step 840). The access of unknown passengers 30 may be restricted to selected floors 9, which are open to the public. Alternatively, the transportation of unknown passengers 30 may be denied.

(65) In order to avoid that passengers 30, who did not identify themselves and/or who did no enter their destination via a landing control panel 7a, join other passengers 30 when boarding the elevator car 6 in order to be transported to one of the floors 9 without having been recognized and checked (piggy-backing), the passengers 30 are identified again after having boarded an elevator car 6 (step 850), and it is checked (step 860) whether all passengers 30 present within the elevator car 6 entered a control input.

(66) In case the monitoring circuit 28 detects that at least one passenger 30, who has not been identified and/or who did not enter his destination, boarded the elevator car 6, the elevator control 24 does not start moving said elevator car 6 (step 870). Instead of moving the elevator car 6, the at least one passenger 30 or all passengers 30 within the elevator car 6 are requested to leave the elevator car 6 in order to (re-) enter his/her/their respective destination call(s) via a landing control panel 7a or the car control panel 7b. The passengers 30 may be requested to leave the elevator car 6 by means of an acoustical announcement played within the elevator car 6, by an optical message displayed within the elevator car 6, e.g. on a display screen 7c provided within the elevator car 6, or by a combination thereof.

(67) On the other hand, the elevator system 2 is operated normally according to the input control inputs (step 880), if all passengers 30 within the elevator car 6 have been identified as having entered a valid control input before boarding the elevator car 6.

(68) Similarly, in order to avoid that passengers 30 leave the elevator car 6 at floors 9 which differ from the destinations entered by the respective passengers 30 (tail-gating), the passengers 30 are monitored and identified again when leaving the elevator car 6 at one of the landings 8 (step 900), and it is checked in step 910 whether the destination floor 9 entered by each passenger 30 leaving the elevator car 6 corresponds with the floor 9 of the respective landing 8.

(69) This functionality can be implemented using sensors 20, in particular cameras, within the elevator car 8 and on the floors 9. In particular, the same sensors 20 that are used for monitoring passengers 30 within or outside the elevator car 6 and determining at least one passenger parameter, as it has been described before, may be used.

(70) When a passenger 30 entered a control input via a landing/car control panel 7a, 7b, said control input may be associated with sensor data, e.g. an image, of the passenger 30. By comparing sensor data received from the sensors 20 when the passenger 30 is leaving the elevator car 6 with the previously stored sensor data associated with said passenger 30, the elevator control 24 is able to check whether the passenger 30 leaves the elevator car 6 at the landing 8/floor 9 corresponding with landing 8/floor 9 provided with the control input.

(71) The elevator control 4 may be configured to issue an alarm signal (intrusion alarm) (step 920) in case tail-gaiting has been detected as the destination floor 9 entered by a passenger 30 leaving the elevator car 6 does not correspond with the floor 9 of the respective landing 8 and the passenger 30 is not authorized to enter the respective floor 9.

(72) In order to prevent unauthorized passenger(s) from intruding into floors 9 they are not allowed to enter, additionally or alternatively to issuing an alarm signal, safety doors 36 provided at the respective floors 9 may be closed (step 930) in case an intrusion has been detected. The safety doors 36 may remain closed until the unauthorized passenger(s) 30 re-boarded the elevator car 6 and/or security personnel arrives at the scene in order to clarify the situation.

(73) In case the passenger 30 is allowed to leave the elevator car 6 at the respective floor 9 although he did not enter the respective floor 9 as his destination, no alarm is issued, but the passenger's 30 control input is deleted in order to avoid an unnecessary stop of the elevator car 6 at the passenger's previously entered destination.

(74) For example, when the passenger 30 input floor 9 number 7 has his destination, but then leaves the elevator car 6 at floor 9 number 5, the elevator control 24 will not cause the elevator car 6 to stop at floor 9 number 7 anymore, unless there is still at least one (other) passenger 30 within the elevator car 6 who entered floor 9 number 5 as his destination or a passenger 30 waiting at floor 9 number 7 is supposed to enter the elevator car 6.

(75) The elevator system 2 continues operating normally according to the control inputs (step 940), if all passengers 30 leaving the elevator car 6 at one of the floors 9 are identified as having entered a control input including said floor 9 as their destination.

(76) While the invention has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adopt a particular situation or material to the teachings of the invention without departing from the essential scope thereof. Therefore, it is intended that the invention shall not be limited to the particular embodiment disclosed, but that the invention includes all embodiments falling within the scope of the dependent claims.