The present invention relates to a method for monitoring an operation status of an elevator. Furthermore, the invention relates to a monitoring device and a computer program product for performing or controlling the proposed method and to a computer readable medium comprising such computer program product stored thereon.

An operation status of an elevator is to be monitored in order to, for example, guarantee a safety of the elevator and/or minimise effects of malfunctions in the elevator. Therein, the operation status may represent conditions within the elevator which affect the elevator’s operation and/or safety. Inter-alia, the operation status may be affected by an integrity of components of the elevator. For example, malfunctions occurring in an elevator drive engine, in an elevator cabin guiding structure within an elevator shaft, in opening mechanisms of an elevator cabin door or an elevator shaft door, etc. may affect the elevator’s capability of safely, precisely and/or smoothly displacing the elevator cabin and/or safely opening and closing the elevator doors.

Various approaches have been proposed in order to monitor an operation status of an elevator. For example, CN 101152941 A describes a function variable remote monitoring system and remote monitoring method for an elevator using a camera for monitoring an abnormality in an elevator cabin. CN 103145014 A describes an elevator remote monitoring device using a microphone for collecting abnormal sound in an elevator.

US 2016/295196 Al describes a method for ensuring that a cabin of an elevator is empty. First, a current load weight of the sensor is sensed lf the sensed load weight is less than a preset threshold, a current depth map is evaluated.

EP 3106417 Al describes a method for maintaining a safety gear of an elevator. First, it is secured that no passenger stays in a cabin of the elevator lf this is ensured, an automated test of the safety gear is started.

There may be a need for a further developed approach for monitoring an operation status of an elevator. Particularly, there may be a need for a method enabling such monitoring without infringing any passengers’ rights or concerns. Furthermore, there may be a need for a monitoring device and a computer program product being specifically configured for implementing such method and for a computer readable medium storing such computer program product.

Such needs may be met with the subject-matter of the independent claims. Advantageous embodiments are defined in the dependent claims and in the following specification.

According to a first aspect of the present invention, a method for monitoring an operation status of an elevator is proposed. Therein, the elevator comprises a first sensor and a second sensor. The first sensor is configured for obtaining first sensor data enabling deriving information about a presence of a passenger within a first sensing area of the first sensor. The second sensor is configured for obtaining second sensor data from within a second sensing area, the second sensor data enabling deriving information about the operation status of the elevator. The method comprises at least the following steps: it is determined whether a passenger is present within the first sensing area of the first sensor. Then, a monitoring procedure is triggered only, i.e. exclusively, in case no passenger is present within the first sensing area of the first sensor. Therein, the monitoring procedure comprises obtaining second sensor data from the second sensor and deriving information about the operation status of the elevator by processing the obtained second sensor data. The first sensor is configured for obtaining first sensor data not enabling deriving information potentially invading into a privacy concerns of a passenger located within a sensing area of the first sensor. The second sensor is one of a camera to supervise the second sensing area for an occurrence of any visually detectable malfunctions and a microphone to supervise the second sensing area for an occurrence of any audibly detectable malfunctions. The processing of the obtained second sensor data could be performed by a monitoring device located at the elevator or by a monitoring unit located away from the elevator. The monitoring unit located away from the elevator may be for example part of a remote monitoring centre, which may be connected to the monitoring device located at the elevator via the internet ln particular, the obtained second data is only transmitted to the named monitoring unit located away from the elevator in case no passenger is present within the first sensing area of the first sensor. According to a second aspect of the present invention, a monitoring device is proposed, the monitoring device being configured to performing and/or controlling a method according to an embodiment of the first aspect of the invention.

According to a third aspect of the invention, an elevator comprising the monitoring device according to an embodiment of the second aspect of the invention is proposed.

According to a fourth aspect of the invention, a computer program product is proposed, the computer program product comprising computer readable instructions which, when performed by a processor of e.g. a monitoring device, instruct the processor to perform the method according to an embodiment of the first aspect of the invention.

According to a fifth aspect of the invention, a computer readable medium is proposed, the computer readable medium comprising a computer program product according to an embodiment of the third aspect of the invention stored thereon.

Ideas underlying embodiments of the present invention may be interpreted as being based, inter alia, on the following observations and recognitions.

As indicated above, various approaches have been proposed in order to monitor an operation status of an elevator by using a camera or a microphone for supervising an area within or adjacent to an elevator.

However, it has been recognised that permanently supervising such area may result in concerns regarding a privacy of passengers using the elevator. For example, it may not be allowed or at least not be desired to acquire camera images of passengers or sounds of passengers allowing detecting an identity of the passengers (it shall be noted that the term “passenger” shall be interpreted herein in a broad manner relating to any person or human being located within, at or close to an elevator).

It is therefore suggested to modify a method and device for monitoring an operation status of an elevator such that privacy of passengers is protected. For that purpose, it is suggested to, first, use a first sensor in order to determine whether a passenger is present in an elevator area. Only in case when no passenger is present, sensor data from a second sensor are acquired and processed such that information about the current operation status of the elevator is derived from such second sensor data. However, if it is determined based on the first sensor data from the first sensor that a person is present within a first sensing area supervised by the first sensor, either acquiring the second data from the second sensor or at least suitably processing such second data is prevented. Preferably, upon detecting a passenger, operation of the second sensor and/or data acquisition from the second sensor is temporarily suppressed.

Since the second sensor is a camera or a microphone it is configured for obtaining second sensor data enabling deriving information potentially invading into privacy concerns of a passenger located within a sensing area of the second sensor ln other words, the second sensor may have sensing characteristics which allow acquiring sensor data which, at least potentially, enable deriving information which could be used to violate rules regarding privacy interests of passengers. Particularly, the second sensor data may be usable for obtaining information about an identity and/or other private information of a passenger.

Therein, a camera may be used to supervise an elevator area in the form of the named second sensor area for an occurrence of any visually detectable malfunctions. For this purpose, the camera measures light intensities with a digital image sensor, i.e. a CCD or a CMOS and transforms the measured data into a picture of the second sensing area. For example, the camera may be used to supervise an elevator cabin door or shaft door for example by imaging a door operation and analysing the images for any abnormality hinting to a malfunction in door operation. However, such camera can, in principle, also be used for taking images of passengers. Particularly if faces of passengers are imaged, an identity of the imaged passenger may be derived from the second sensor data, thereby contravening the passenger’s privacy interests.

Similarly, a microphone may be used to supervise an elevator area in the form of the named second sensor area for an occurrence of any audibly detectable malfunctions. For example, the microphone may be used to supervise the elevator cabin door or shaft door for example by recording a sound produced by the door upon opening or closing and analysing such sound for any abnormality hinting to a malfunction in door operation. However, such microphone can, in principle, also be used for recording sounds of passengers. Particularly if voices of passengers are recorded, an identity of the passenger may be derived from the second sensor data, thereby contravening the passenger’s privacy interests.

Contrary to the second sensor, the first sensor is configured for obtaining first sensor data not enabling deriving information potentially invading into a privacy concerns of a passenger located within a sensing area of the first sensor ln other words, while the first sensor data may enable detecting whether or not a person is located within the first sensing area supervised by this first sensor, such first sensor data preferably do not contain sufficient information which allow deriving any privacy invading information about the passenger located in the first sensing area.

For example, the first sensor may sense physical parameters which change upon the presence of a person, but which do not allow deriving information about an identity and/or other private details of the person. Generally, the first sensor may use optical, acoustical, electrical, magnetic, electromagnetic or any other physical measuring techniques.

For example, the first sensor may be an RGB sensor, an 1R sensor, a load sensor or a depth sensor.

An RGB sensor may distinguish light intensities in three different colours, red, green and blue. Based on first sensor data representing the light intensities in these colours, information about the presence or absence of a passenger may be derived. For example, baseline data may be acquired in a learning procedure when the first sensing area is free of any person. Later, acquired first sensor data may be compared with such baseline data and upon detecting any significant change in the RGB light intensities, it may be assumed that a person has entered the first sensing area. Preferably, the RGB sensor has no capacity for any spatial resolution of RGB light intensity information. For example, the RGB sensor may comprise three photodiodes, each being equipped with one of a red, green and blue light filter, respectively. An IR sensor may measure infrared light intensities occurring within a sensing area. Generally, a person emits infrared radiation due to its elevated body temperature. The IR sensor may detect such infrared radiation such that, based on the first sensor data, information may be derived upon whether or not a person is present within the first sensing area. Preferably, the 1R sensor has no or only a minor capacity for any spatial resolution. For example, the 1R sensor may comprise one or a few photodiodes which are sensitive in the infrared electromagnetic spectrum.

As another option, the first sensor may be a load sensor. Such load sensor may sense loads or forces. For example, such load sensor may be used to measure loads or forces in the elevator cabin. Having a baseline data indicating loads occurring upon the elevator cabin being empty, any subsequently acquired first sensor data may be compared with such baseline data, thereby enabling detecting when a passenger enters the elevator cabin ln this example, the first sensing area may be the area in which occurrence of loads or forces is detected by the load sensor. While the load sensor may provide information about a weight of a person entering the elevator cabin, such information may not be used for deriving any privacy invading information about the passenger.

As a further option, the first sensor may be a depth sensor. Such a sensor can be operable in the optical, electromagnetic or acoustic spectrum capable of producing a depth map (also known as a point cloud or occupancy grid) of the first sensing area. The presence of a passenger can be detected based on the named depth map, i.e. by comparing a measured depth map with a stored depth map without a passenger inside the first sensing area.

According to an embodiment, the first sensing area and the second sensing area are overlapping or even coinciding ln other words, the sensing area supervised by the first sensor and the sensing area supervised by the second sensor at least partially overlap or, preferably, completely overlap or, more preferably, coincide. Accordingly, when the first sensor measures first sensor data indicating that a passenger is present within its first sensing area, use of the second sensor may temporarily be stopped such that no privacy invading information about passengers located within this sensing area may be derived from any second sensor data. The monitoring device according to the second aspect of the invention may comprise the first and second sensors as indicated above and may further comprise a data processor being configured for determining, based on the first data, whether a passenger is present within the first sensing area of the first sensor and triggering a monitoring procedure only in case no passenger is present within the first sensing area. Therein, the monitoring procedure comprises obtaining second sensor data from the second sensor and deriving information about the operation status of the elevator by processing the obtained second sensor data. ln other words, the data processor may be configured for executing or controlling steps of embodiments of the method proposed herein. For such purpose, the data processor may comprise a central processing unit (CPU) for processing data and memory for storing data. Particularly, baseline data representing conditions in which no passenger is present within the first sensing area may be stored in the memory and the central processing unit may then compare actually acquired first sensor data with such baseline data in order to thereby detect the presence of any passenger lf no passenger is detected, a monitoring procedure may be triggered. Such monitoring procedure may be executed within the same data processor or in a separate data processing unit. The monitoring procedure may use second sensor data which, in principle, could be used for deriving privacy invading information. However, as no passenger is present within the second sensing area of the second sensor, it can be guaranteed that such sensor data is exclusively used for deriving information about the current operation status of the elevator.

The elevator according to the third aspect of the invention may generally comprise the proposed monitoring device at any location in or adjacent to an elevator shaft or an elevator cabin displaced therein.

For example, the elevator may comprise a monitoring device within the elevator cabin for monitoring cabin elements such as the cabin doors and/or a cabin operation panel (COP) ln that case, the first and second sensing areas may be within the elevator cabin. For example, a camera and/or a microphone may be used to supervise correct operation of a cabin door. Alternatively, the elevator may comprise a monitoring device next to a shaft door within a floor of a building served by the elevator in order to supervise the shaft door and/or the entrance to the elevator cabin. In that case, the first and second sensing areas may be within the floor neighbouring the shaft door.

The computer program product according to the fourth aspect of the invention may be programmed in any computer readable language. It may comprise instructions which, when performed on a data processor or central processing unit of a monitoring device result in executing or controlling the monitoring method proposed herein.

The computer readable medium according to the fifth aspect of the invention stores the computer program product in any technical manner, i.e. in a way such that the instructions of the computer program product may be read out from the computer readable medium by a machine. The computer readable medium may be for example a CD, a DVD, a flash memory, RAM, ROM, etc. The computer readable medium may also be the memory of an entire computer or server or of a data cloud. The computer program product may be downloaded from the computer readable medium directly or for example via a network such as the Internet. ft shall be noted that possible features and advantages of embodiments of the invention are described herein partly with respect to a monitoring method and partly with respect to a monitoring device. One skilled in the art will recognize that the features may be suitably transferred from one embodiment to another and features may be modified, adapted, combined and/or replaced, etc. in order to come to further embodiments of the invention.

In the following, an advantageous embodiment of the invention will be described with reference to the enclosed drawing. However, neither the drawing nor the description shall be interpreted as limiting the invention.

Fig. 1 shows a partial view onto an elevator comprising a monitoring device according to an embodiment of the present invention.

The figure is only schematic and not to scale. Fig. 1 shows an elevator 1 comprising a monitoring device 3 according to an embodiment of the present invention. The elevator 1 comprises an elevator cabin 5 which may be entered by a passenger for being transported from a starting floor 7 to a destination floor. While waiting at the starting floor 7, the passenger may use a landing operation panel (LOP) 9 for calling the elevator cabin 5. Upon having entered the elevator cabin 5, the passenger may use a cabin operation panel (COP) 11 for indicating his destination floor.

Within the elevator cabin 5, a camera 15 and a microphone 17 may be provided, both being referred to as second sensors 13. The camera 15 and the microphone 17 record data from inside the elevator cabin. So, the elevator cabin can be considered as a second sensing area. Next to the landing operation panel 9 at the floor 7, for example another microphone 19 may be provided and may form another second sensor 13.

Such second sensors 13 may provide second sensor data which may be used for deriving information about a current operation status of the elevator 1. For example, the camera 15 may be used for imaging a motion operation of elevator doors 21 such as a cabin door and/or a shaft door. Upon image analysis, malfunctions of such elevator door 21 may be detected. Similarly, the microphones 17, 19 may be used for detecting any abnormal sounds indicating malfunctions in such elevator door 21.

Generally, cameras 15 and microphones 17 may provide rich data streams for the detection of technical equipment malfunction ln some contexts, however, an identity of a passenger or a passenger behaviour may also be captured by such second sensors 13 while the passenger interacts with the monitored elevator equipment. Sometimes, if such sensing equipment potentially violates a reasonable presumption of privacy, it may not be utilised.

To allow a deployment of such second sensors 13 while preserving people’s privacy, a privacy preserving triggering mechanism is suggested to activate potentially privacy invading-sensors 15, 17 only when humans are absent, i.e. no person is present in, at or close to the elevator 1. ln order to enable detecting the presence of a person, additional first detectors 23 are provided within the elevator 1. Generally, different methods of human presence detection may be envisioned, depending on a context. Herein, a focus shall be set onto elevator cabin monitoring using examples of possible passenger detection methods.

For example, an RGB sensor 25 may be provided as an exemplary type of a first sensor 23 within the elevator cabin 5. The RGB sensor 25 records data from inside the elevator cabin. So, the elevator cabin 5 can be considered as a first sensing area. A baseline RGB value of an empty elevator cabin 5 may be recorded. If necessary, multiple baseline RGB values may be recorded for different foreseeable lighting conditions, e.g. at different times of the day or different opening and closing stages of the elevator door 21.

Subsequently, the baseline RGB value(s) may be compared with RGB values continuously or repeatedly acquired during operation of the elevator 1. Using such first sensor data, it may be determined whether or not a passenger has entered the elevator cabin 5. In case, a passenger is present within the elevator cabin 5, operation of the cameras 15 and the microphone 17 forming the second sensors 13 is temporarily suspended and/or no second sensor data provided by such second sensors 13 is acquired and further processed.

As another example, an IR sensor 27 may be provided as a first sensor 23 next to the landing operation panel 9. The IR sensor 27 records data from inside the elevator cabin. So, the elevator cabin 5 can be considered as a first sensing area. Such IR sensor 27 may be a passive IR-based motion sensor and may detect any heat emission from humans waiting at the floor 7. For example, if heat emission from a body at approximately 37°C is detected, presence of a waiting passenger may be assumed and operation of the microphone 19 may temporarily be suspended.

As a further alternative, a load sensor 29 may be provided as a first sensor 23. Such load sensor 29 may directly gauge whether additional weight resulting from entered passengers occurs within the elevator cabin 5. The load sensor 29 may be provided for example at a bottom 6 of the elevator cabin 5 or at a suspension of the elevator cabin 5. So, the bottom 6 of the elevator cabin 5 can be considered as a first sensing area. Overall, once human presence is detected, potentially privacy-invading audio and/or visual supervision using the second sensors 13 is temporarily stopped until absence of the human is established again. Accordingly, the audio and visual second sensors 13 are activated only when no passenger is present, i.e. for example when the elevator cabin is running empty to fetch passengers. Detection of passenger presence using the first sensors

23 is generally run continuously in parallel and interrupts this audio/visual second data acquisition upon passenger presence is detected.

The first sensor data acquired from the first sensors 23 may be processed by a data processor 31 in the monitoring device 3. Furthermore, the second sensor data acquired from the second sensors 13 may also be processed by the data processor 31.

Alternatively, upon determining that no passenger is present, the monitoring device 3 may trigger data processing of the second sensor data in another monitoring unit 33. Such other monitoring unit 33 may be for example part of a remote monitoring centre 35 supervising the operation of the elevator 1 , which may be connected to the monitoring device via the internet 37.

Accordingly, with the approach proposed herein, privacy issues may be alleviated, such privacy issues otherwise possibly preventing a use of sensing modalities using for example cameras, microphones or other sensors providing privacy-invading data.

Accordingly, such sensing modalities may be used for deriving information about a current operation status of the elevator.

Finally, it should be noted that the term“comprising” does not exclude other elements or steps and the“a” or“an” does not exclude a plurality. Also, elements described in association with different embodiments may be combined ft should also be noted that reference signs in the claims should not be construed as limiting the scope of the claims.