The technology described herein generally relates to a method for operating an elevator. More particularly, the technology relates to a method for ensuring a safe maintenance of an elevator. The technology described herein further relates to a controller for an elevator, a controller for a safety device, an elevator, a computer program, and a computer readable medium comprising the computer program.

Elevators serve for transporting passengers with an elevator car throughout a building. Typically, a multiplicity of passengers may be accommodated within the car and may then be transported for example from a first floor to a second floor in the building. In this description, the terms “first” and “second” are used in this context only to differentiate one floor from another and not for stating that e.g. the first floor is in fact the first floor of the building. Therefore, the first and second floor may be any two different floors of a building. During such travel, further passengers may enter or exit the car during intermediate stops at other floors. The car moves vertically from one floor to the other through a hoistway of the building.

An elevator has to be maintained by a maintenance worker on a regular basis, e.g. in accordance with a regular maintenance interval or because of a fault of the elevator. The worker is facing different dangerous situations, which pose a threat to the worker, when maintaining the elevator. For example, the worker has to access a top of the car, the hoistway, and/or a pit of the hoistway in order to be able to maintain the elevator.

Entering the top of the car, the hoistway, or the pit of the hoistway is dangerous, because of the height of the hoistway, because of the movement of the car, because of the movement of another car in the hoistway, because of other moving objects in the hoistway, such as a counterweight of the elevator or the other elevator, and/or because of dangerous devices in the hoistway, e.g. devices being operated with high voltage and/or high voltage current. Therefore, the top of the car, the hoistway, in particular outside of the top of the car and outside a path of the car, the pit of the hoistway, and/or the areas around dangerous devices are referred to as risk areas of the elevator. In order to maintain the elevator safely, the worker has to wear safety devices corresponding to the risk area he has to access. For example, if the worker wants to access the pit of the hoistway, the worker has to wear a helmet. If the worker wants to access the top of the car, the worker has to wear the helmet and a harness, and so forth. However, sometimes the workers forget to wear the safety device, wear the wrong safety device, wear the safety device not correctly, and/or wear an old safety device which already has expired, when accessing one or more risk areas of the elevator. Then, if a dangerous situation occurs, the worker is not properly protected and may be hurt or even killed. In fact, many fatalities and injuries happening to a maintenance worker on an elevator are due to not using, not properly using, and/or using old safety devices. The safety devices each may also be referred to as Personal Protection Equipment (PPE).

Accordingly, there is a need for a method for ensuring a safe maintenance of an elevator. In particular, there is a need for a method for ensuring a safe maintenance of an elevator, which enhances the safety for the worker and which brings more workers home to their families. In particular, there is a need for a method for ensuring a safe maintenance of an elevator, which decreases the number of fatalities and injuries happening on elevator equipment, especially due to not using, not properly using, and/or using old safety devices.

Such needs are met by the subject-matter of the independent claims. Advantageous embodiments are defined in the dependent claims as well as in the following specification and the associated figures.

According to a first aspect of the technology described herein, a method for ensuring a safe maintenance of an elevator is proposed, wherein the method comprises at least the following steps, preferably in the indicated order: receiving, by a controller of the elevator, a safety signal from at least one safety device worn by a maintenance worker, if the worker wants to have access to a risk area of the elevator, with at least one safety relevant information about the safety device being encoded in the safety signal; decoding the safety-relevant information from the safety signal; determining whether the safety device fulfills at least one predetermined requirement for accessing the risk area from the safety-relevant information; and granting access to the risk area, if the safety device fulfills the predetermined requirement for accessing the risk area. For example, the safety device may comprise a separate controller, which may decode the safety-relevant information in the safety signal. The safety-relevant information may be generated by the controller of the safety device, e.g. with the help of one or more sensors of the safety device, or may be stored on a memory of the safety device which is coupled to the controller of the safety device. The safety-relevant information then may be communicated to the controller of the elevator. In particular, the safety signal may be sent from the controller of the safety device, e.g. via a sender of the safety device communicating with the controller of the safety device, to a receiver of the elevator. The received safety signal may be forwarded to the controller of the elevator and may be received by the controller of the elevator. The controller of the elevator may decode the safety signal in order to extract the safety-relevant information from the safety signal. Then, the controller is able to check the fulfillment of the predetermined requirement against the safety-relevant information. It may be determined whether the safety device fulfills the at least one predetermined requirement for accessing the risk area from the safety-relevant information by consulting a lookup table which assigns the safety-relevant information to predetermined requirements for accessing the risk areas and which may be stored in a memory of the controller of the elevator. The access to the risk area may be granted by sending an enable signal to a door of the elevator, a maintenance flap of the elevator or the car, and/or an opening mechanism of the elevator, e.g. an opening mechanism of the door of the elevator.

Communicating the safety signal containing the safety-relevant information about the safety device from the safety device to the controller of the elevator contributes to include safety checks regarding the safety devices into the controller of the elevator. This contributes to ensuring a safe maintenance of the elevator, to enhance the safety for the worker and to bring more workers home to their families. In particular, the above method contributes to decrease the number of fatalities and injuries happening on elevator equipment, especially due to not using, not properly using, and/or using old safety devices.

The safety signal may be broadcasted by the safety device continuously. Alternatively, the safety signal may be sent to the controller of the elevator in response to a request signal of the controller of the elevator. For example, the controller of the elevator senses the safety device, if the worker wearing the safety device approaches one of the risk areas of the elevator, e.g. by a corresponding proximity sensor, and sends the request signal before granting access to the corresponding risk area. The risk area of the elevator may be a top of the car, a hoistway of the elevator, a pit of the hoistway, and/or an area around and/or around a dangerous device within the hoistway.

The safety-relevant information may relate to whether the safety device is worn by the worker, to a type of the safety device, to whether the safety device is worn by the worker correctly, to whether the safety device is properly engaged to a safety means of the elevator, and/or to an expiration date of the safety device. The predetermined requirement may relate to whether the worker wears the safety device, to whether the worker wears the correct type of the safety device for accessing the corresponding risk area, to whether the safety device is worn by the worker correctly, to whether the safety device is properly engaged to a safety means of the elevator, and/or to whether the safety device has not expired. Further, in order to grant or deny the access to the risk area, it may be determined whether the safety device fulfills two or mor of the above predetermined requirements for accessing the risk area from corresponding two or, respectively, more of the safety-relevant information.

According to one embodiment each safety-relevant information encoded in the safety signal corresponds to one predetermined requirement. In other words, there may be a one- to-one association of the safety-relevant information to the predetermined requirement. This one-to-one association may be defined in the lookup table. So, the fulfillment of the predetermined requirement may be determined by checking the corresponding safety relevant information. This enables to efficiently check the fulfillment of different safety- related requirements.

According to one embodiment the safety-relevant information is at least one of the group of: that the safety device is worn by the worker, wherein the predetermined requirement is that the safety device is worn by the worker; the type of the safety device, wherein the predetermined requirement is that the safety device is the proper type of the safety device for accessing the corresponding risk area; the safety device being worn by the worker correctly, wherein the predetermined requirement is that the safety device is worn by the worker correctly; the safety device being properly engaged to a safety means of the elevator, wherein the predetermined requirement is that the safety device is properly engaged to the safety means; and the expiration date of the safety-device, wherein the predetermined requirement is that the safety device has expired.

The type of the safety device may be helmet, harness, wristband, etc. The helmet may protect the head of the worker. The harness may hold the worker, if the worker falls into the hoistway. The wristband may comprise an electronic circuit, for example an RFID chip or a sender, which may be detected by a sender of the elevator or, respectively, which may send a proximity signal to a corresponding receiver of the elevator.

It may be determined that the worker wears the safety device by a first sensor of the safety device. For example, the first sensor may be a proximity sensor or a temperature sensor which recognizes, if the safety device is close to a body of the worker. It may be determined that the helmet, harness, and/or wristband is the proper type of the safety device for accessing the corresponding risk area, for example by consulting the lookup table.

It may be determined that the safety device is worn by the worker correctly by a second sensor of the safety device. The safety device may be determined as being worn properly, if all fasteners of the safety device are closed. The closing position of the fasteners may be sensed by the second sensor. The second sensor may also be used for sensing whether the safety device is worn at all. In other words, the first sensor and the second sensor may be one single sensor.

The safety device may be determined as being properly engaged to the safety means of the elevator by a third sensor. The third sensor may be coupled to engaging means of the safety means and senses, if the engaging means of the safety means is engaged to the safety means of the elevator. In addition, a fourth sensor of the elevator may be coupled to the safety means of the elevator and may sense if the engaging means is engaged to the safety means.

The expiration date of the safety-device may be stored in a memory of the safety device which is coupled to the controller of the safety device. According to one embodiment the method further comprises sending an enable signal to another controller of the elevator, the other controller being responsible for granting and denying access to the risk area and/or another risk area of the elevator. As such, the elevator comprises two or more controllers, wherein at least two of the controllers are responsible for granting and denying access to corresponding risk areas of the elevator. For example, a first controller of the elevator is responsible for the movement of the car and a second controller is responsible for opening and closing a door for entering the hoistway. Then, if the worker wants to access e.g. the top of the car, the enable signal may be sent to the first and second controller or may be sent from the first controller to the second controller or vice versa.

According to one embodiment the method further comprises monitoring a position of the worker relative to the elevator by monitoring a position of the safety device; and sending a warning signal to the worker, if the worker approaches another risk area of the elevator. As such, if the worker is already in a risk area of the elevator and approaches another risk area of the elevator the warning signal may be sent to the worker. For example, if the worker is on top of the car or in the pit of the hoistway and approaches the dangerous device in the hoistway, for example the high voltage and/or high voltage current device or the counterweight of the car, the warning signal may be sent to the worker. Alternatively or additionally, if the worker works on top of the car and a part of the body of the worker, for example the head or an arm of the worker extends from the car outwardly, the warning signal may be sent to the worker. This may be particularly advantageous, if the elevator is configured such that the counterweight of the car, another car, and/or a counterweight of another car may closely pass the car, because the counterweight of the car, the other car or, respectively, the counterweight of the other car may hurt the worker, in particular the head or arm of the worker, if the worker would not be warned accordingly.

According to one embodiment the safety signal is automatically received, if the worker approaches the risk area of the elevator. For example, the safety device and/or the elevator may detect the approaching of the worker wearing the safety device to the risk area by a proximity sensor of the safety device and/or the elevator, wherein a proximity signal of the proximity sensor may trigger the generation and sending of the safety signal, if the proximity sensor belongs to the safety device, or the proximity sensor may trigger the generation and sending of the request signal of the elevator, if the proximity sensor belongs to the elevator.

According to one embodiment the method further comprises sending an access signal to the worker, if access to the risk area is granted; and sending a denial signal to the worker, if access to the risk area is not granted, wherein the denial signal is representative for the reason why the access is not granted. The access may not be granted because the worker does not wear the safety device, because the type of safety device does not fit to the corresponding risk area, because the safety device is not worn correctly, e.g. one or more fasteners of the safety device are not closed, because the safety device is not properly engaged to the safety means of the elevator, and/or because the safety device has expired. The denial signal being representative for the reason why the access is not granted enables the worker to effectively take one or more measures for getting access to the risk area. For example, if the worker does not wear a helmet, a harness or a wristband, but wearing the helmet, the harness or, respectively, the wristband is obligatory for accessing the risk area, the denial signal may inform the worker that he has to wear the helmet, the harness or, respectively the wristband. Then, the worker is able to attire the corresponding safety device in order to get access to the corresponding risk area.

The above features, advantages and/or effects of the method for ensuring the safe maintenance of the elevator may be transferred to the controller of the elevator, to the method for ensuring the safe maintenance carried out by the safety device, the controller of the safety device, the computer program, and/or the computer readable medium, each explained in the following.

It shall be noted that the above features, advantages and/or effects of the embodiments of the technology described herein are described partly with respect to the above method and partly with respect to the controller of the elevator, to the method for ensuring the safe maintenance carried out by the safety device, the controller of the safety device, the computer program, and/or the computer readable medium, each explained in the following. One skilled in the art will recognize that these features, advantages and/or effects may be suitably transferred from one embodiment to another and/or from the above first aspect to one or more of the following aspects. Therefore, with due regard to a concise description of the present invention, a repetitive explanation of these features, advantages and/or effects is omitted in the following and it is referred to the above explanations only. Further, features of different embodiments may be modified, adapted, combined and/or replaced, etc. in order to come to further embodiments of the technology described herein.

According to a second aspect of the technology described herein, the controller for the elevator is proposed. The controller for the elevator comprises a processor and a memory and is configured for carrying out and/or controlling the above method.

According to a third aspect of the technology described herein, a method for ensuring a safe maintenance of the elevator is provided, wherein this method is carried out by the safety device, in particular the controller of the safety device. The method comprises determining, by the controller of the predetermined safety device, at least one safety relevant information about the safety device; encoding, by the controller of the predetermined safety device, the safety-relevant information in the safety signal; and sending the safety signal from the safety device to the controller of the elevator.

According to one embodiment the safety-relevant information is at least one of the group of that the worker wears the safety device; the type of the safety device; the safety device being worn by the worker correctly; the safety device being properly engaged to the safety means of the elevator; and the expiration date of the safety-device.

According to a fourth aspect of the technology described herein, the controller for the safety device of the maintenance worker is provided. The controller for the safety device comprises a processor and a memory and is configured for carrying out and/or controlling the above method.

According to a fifth aspect of the technology described herein, the elevator is provided. The elevator comprises: the car being arranged in the hoistway such that the car is vertically movable within the hoistway; the motor being coupled to the car and configured to move the car vertically within the hoistway; at least one risk area within the car or the hoistway; the opening mechanism for granting and denying access to the risk area; and the above controller of the elevator being coupled to the motor for controlling the motor and as such the vertical movement of the car, and being coupled to the opening mechanism for controlling the access to the risk area.

According to a sixth aspect of the technology described herein, the computer program comprises instructions, which when being carried out by the controller of the elevator causes the controller to carry out and/or control the above method. In particular, the computer program comprises computer readable instructions which, upon being executed by the processor of the controller of the elevator, instruct the controller to execute the method according to the first aspect of the technology described herein.

According to a seventh aspect of the technology described herein, a computer readable medium comprising the above computer program is provided. For example, the computer readable medium may have stored thereon the above computer program. For example, the computer readable medium may be a volatile or non-volatile data memory. For example, the computer readable medium may be a flash memory, a DVD, a CD, a ROM, a RAM, an EPROM or similar devices. Alternatively, the computer readable medium may be part of another computer or server or of a data cloud from which the computer program product may be downloaded for example via a network such as the Internet.

Ideas underlying embodiments of the technology described herein may be interpreted as being based, inter alia, on the following observations and recognitions.

Embodiments of the method described herein may be implemented in hardware, software or a combination thereof. Particularly, the computer program may comprise the computer readable instructions which instruct the processor of the controller of the elevator or the safety device to execute or control the method steps. The computer program may be provided in any computer readable language.

In the following, advantageous embodiments of the technology described herein will be described with reference to the enclosed drawings. However, neither the drawings nor the description shall be interpreted as limiting the technology described herein.

Fig. 1 shows a maintenance worker and an embodiment of an elevator, according to an embodiment of the technology described herein. Fig. 2 shows a maintenance worker and an embodiment of an elevator, according to an embodiment of the technology described herein.

Fig. 3 shows a maintenance worker and an embodiment of an elevator, according to an embodiment of the technology described herein.

Fig. 4 shows a maintenance worker and an embodiment of an elevator, according to an embodiment of the technology described herein.

Fig. 5 shows several safety devices communicating with a computer, according to an embodiment of the technology described herein.

Fig. 6 shows a flow chart of an embodiment of a method for ensuring a safe maintenance of an elevator, according to an embodiment of the technology described herein.

Fig. 7 shows a flow chart of an embodiment of a method for ensuring a safe maintenance of an elevator, according to an embodiment of the technology described herein.

Fig. 8 shows a flow chart of an embodiment of a method for ensuring a safe maintenance of an elevator, according to an embodiment of the technology described herein.

The figures are only schematic and not to scale. Same reference signs refer to same or similar features.

Fig. 1 shows a maintenance worker 40 and an elevator 20, according to an embodiment of the technology described herein. The elevator 20 comprises a car 22, a hoistway 24, a car holder 30, a cable 32, a motor 34, a controller 35, an opening mechanism 37, a first door 36 and a second door 38. The maintenance worker 40 wears at least one, preferably several safety devices, in particular a helmet 42, a harness 44, and a wristband 46.

The elevator 20 is arranged in the building having several floors. In particular, the building may have a first floor 26 and a second floor 28, wherein in this context the terms “first” and “second” are only used to differentiate one floor from another and may refer to any of the floors of the building. The elevator 20 is arranged for transporting a load, e.g. one or more people and/or any another load, from one floor to the other, for example from the first floor 26 to the second floor 28 or vice versa.

The car 22 is configured for accommodating the load, i.e. the one or more people and/or the other load. The load and/or the worker 40 may enter the car 22 through the first door 36, if the car 22 is in the first floor 26, or the second door 38, if the car 22 is in the second floor 28. The car 22 may comprise maintenance flap (not shown) through which the worker 40 may enter the car 22 from the top of the car 22 or through which the worker 40 may climb on the top of the car 22. The car 22 is held and may be vertically transported within the hoistway by the car holder 30 and the cable 32. The cable 32 may be moved by the motor 34. The motor 34 may be controlled by the controller 35. Additionally, the controller 35 may control the opening mechanism 37. Alternatively, the elevator 20 may comprise one or more further controllers, which may communicate with the controller 35 of the elevator 20, wherein at least one of these further controllers may control the opening mechanism 37. The opening mechanism 37 is coupled to the second door 38 and is configured to open or close the second door 38 upon receiving a corresponding signal from the corresponding controller, e.g. the controller 35 of the elevator 20. The elevator 20 may comprise another opening mechanism (not shown), which is coupled to the first door 36, which is configured to open and close the first door 36 and which communicates with corresponding controller, e.g. the controller 35 of the elevator 20.

The elevator 20 may comprise one or more risk areas. A risk area is an area, in which the worker 40 may be in danger. The risk areas may comprise the top of the car 22, an area outside of the path of the car 22, e.g. an area next to the car 22, an area close to a dangerous device 52 of the elevator 20 (see figure 3), and/or a pit 54 of the hoistway 42 (see figure 4).

The worker 40 may wear more or less safety devices 42, 44, 46. For example, the worker 40 may only wear the helmet 42, or may only wear the helmet 42 and the harness 44.

Each of the safety devices 42, 44, 46 may comprise a controller (not shown) of the corresponding safety device 42, 44, 46. Additionally, each of the safety devices 42, 44, 46 may comprise one or more sensors and/or a transmitter. The controllers of the safety devices 42, 44, 46 may communicate with the corresponding senders and transmitters of the safety devices 42, 44, 46. The sensors of the safety devices 42, 44, 46 may be arranged and configured such that signals of the sensors may be representative for that the corresponding safety device 42, 44, 46 is worn by the worker 40, that the corresponding safety device 42, 44, 46 is worn by the worker correctly, and/or that the corresponding safety device, in particular the harness 44, is engaged to a safety means of the elevator 20 (see figure 2).

The controllers of the safety devices 42, 44, 46 are configured to receive the signals of the sensors, and to encode the corresponding safety-relevant information in a safety signal. The safety-relevant information may be that the corresponding safety device 42, 44, 46 is worn by the worker 40, that the corresponding safety device 42, 44, 46 is worn by the worker correctly, and/or that the corresponding safety device, in particular the harness 44, is engaged to a safety means of the elevator 20. Further, the controllers of the safety devices 42, 44, 46 may be configured to encode as the safety-relevant information the type of the safety device, i.e. helmet 42, harness 44, wristband 46, and/or an expiration date of the corresponding safety device 42, 44, 46. The controllers of the safety devices 42, 44, 46 may send the safety signal comprising the safety-relevant information to the controller 35 of the elevator 20.

The controller 35 of the elevator 20 may check at least one predetermined requirement for accessing one or more of the risk areas of the elevator 20 against the safety-relevant information encoded in the safety signal of the safety devices 42, 44, 46. If the safety relevant information satisfy the predetermined requirement, the controller 35 may grant access to the corresponding risk area. If the safety-relevant information does not satisfy the predetermined requirement, the controller 35 may deny the access to the corresponding risk area. For example, if the worker 40 wants to access the top of the car 22 through the second door 38 and if the safety-relevant information satisfy the predetermined requirement, the controller 35 of the elevator 20 may control the motor 34 such that the top of the car 22 is accessible through the second door 38 and may control the opening mechanism 37 such that it opens the second door 38.

Further functionalities of the controller 35 of the elevator 20 are explained below with respect to figure 6 and further functionalities of the safety devices 42, 44, 46 are explained below with respect to figure 7. Fig. 2 shows a maintenance worker and an elevator, according to an embodiment of the technology described herein, e.g. the worker 40 and the elevator 20. The worker 40, the safety devices 42, 44, 46 worn by the worker 40 and/or the elevator 20 may widely correspond to the worker 40, the safety devices 42, 44, 46 and, respectively, the elevator 20 as explained above. Therefore, only those features and functionalities of the safety devices 42, 44, 46 and, respectively, the elevator 20 are explained in the following, which are different from the safety devices 42, 44, 46 and, respectively, the elevator 20 described with respect to figure 1.

In figure 2, the worker 40 is on the top of the car 22. The elevator 20 may comprise safety means 48. For example, the car 22 comprises the safety means 48. Alternatively, the safety means 48 may be arranged at the hoistway 24. The safety means 48 may be arranged for being a coupled to the harness 44. The safety means 48 may be coupled to the harness 44 by a rope 49. The safety means 48 may comprise first engaging means through which the rope 49 may be engaged to the safety means 48. The first engaging means may comprise a stable metal ring. The rope 49 may be engaged to the metal ring and/or the harness 44 by a first and, respectively, second carabiner. If the worker 40 falls from the top of the car 22 the worker 40 is held by the harness 44, the rope 49 and the safety means of 48 such that severe injury of the worker 40 may be prevented. The harness 44 may comprise a sensor (not shown) which is configured to sense whether the rope 49 is properly attached to the harness 44. The sensor of the harness 44 may communicate with the controller of the harness 44. For example, the sensor of the harness 44 may send a signal to the controller of the harness 44, which is representative for the harness 44 being properly engaged to the safety means 48 via the rope 49. Further, the safety means 48 may comprise a sensor (not shown) which is configured to sense whether the rope 49 is properly attached to the safety means 48. The sensor of the safety means 48 may communicate with the controller of the elevator 20. For example, the sensor of the safety means 48 may send a signal to the controller of the elevator 20, which is representative for the harness 44 being properly engaged to the safety means 48 via the rope 49.

Alternatively or additionally to the safety means 48 of the elevator 20 may comprise one or more sensors (not shown) for monitoring whether the worker 40 approaches another risk area. In particular, a position of the worker relative to the elevator may be monitored by monitoring a position of one of the safety devices 42, 44, 46 and a warning signal may be sent to the worker 40, if the worker 40 approaches another risk area of the elevator 20. For example, the elevator 20 may comprise a sensor (not shown) for monitoring whether the worker 40, in particular body part of the worker 40, e.g. an arm and/or a head of the worker 40, approaches the other risk area. As such, the sensor may communicate with the helmet 42 and/or, respectively, the wristband 46 and/or may be able to detect the wristband approaching the other risk area. For example, the other risk area is an area within the hoistway 24 and outside of the path of the car 22. In figure 2, this risk area is schematically shown by the dashed safety line 50, wherein in the real 3D-world the safety line 50 may be a safety plane. If the worker 40, in particular the arm of the worker 40 at which the wristband 46 is attached and/or the head of the worker 40 on which the helmet 42 is placed, crosses the safety line 50 the sensor may detect the wristband 46 and/or, respectively, the helmet and may send the corresponding warning signal to the worker 40. The warning signal may be an acoustical or optical signal, provided for example by the speaker and/or, respectively, a light source of the elevator 20 and/or at least one of the safety devices 42, 44, 46.

Further functionalities of the controller 35 of the elevator 20 are explained below with respect to figure 6 and further functionalities of the safety devices 42, 44, 46 are explained below with respect to figure 7.

Fig. 3 shows a maintenance worker and an elevator, according to an embodiment of the technology described herein, e.g. the worker 40 and the elevator 20. The worker 40, the safety devices 42, 44, 46 worn by the worker 40 and/or the elevator 20 may widely correspond to the worker 40, the safety devices 42, 44, 46 and, respectively, the elevator 20 as explained above. Therefore, only those features and functionalities of the safety devices 42, 44, 46 and, respectively, the elevator 20 are explained in the following, which are different from the safety devices 42, 44, 46 and, respectively, the elevator 20 described with respect to figures 1 and 2.

In figure 3, another situation is shown in which the elevator 20 may comprise one or more sensors (not shown) for monitoring whether the worker 40 approaches another risk area. For example, the other risk area is an area within the hoistway 24 and close to and/or around the dangerous device 52. The dangerous device 52 may for example be a high voltage and/or high voltage current device, a counterweight of the car 22, another car 22 within the hoistway 24, a counterweight of the other car 22. If the worker 40, in particular the arm at which the wristband 46 is attached or the head on which the helmet 42 is placed, approaches the dangerous device 52 a corresponding sensor (not shown) may detect the wristband 46 and/or the helmet 42 and may send the corresponding warning signal to the worker 40. The warning signal may be an acoustical or optical signal, provided for example by a speaker and/or, respectively, a light source of the elevator 20 and/or at least one of the safety devices 42, 44, 46.

Further functionalities of the controller 35 of the elevator 20 are explained below with respect to figure 6 and further functionalities of the safety devices 42, 44, 46 are explained below with respect to figure 7.

Fig. 4 shows a maintenance worker and an embodiment of an elevator, according to an embodiment of the technology described herein, e.g. the worker 40 and the elevator 20. The worker 40, the safety devices 42, 44, 46 worn by the worker 40 and/or the elevator 20 may widely correspond to the worker 40, the safety devices 42, 44, 46 and, respectively, the elevator 20 as explained above. Therefore, only those features and functionalities of the safety devices 42, 44, 46 and, respectively, the elevator 20 are explained in the following, which are different from the safety devices 42, 44, 46 and, respectively, the elevator 20 described with respect to figures 1 to 3.

In figure 4, another situation is shown in which the elevator 20 may comprise one or more sensors (not shown) for monitoring whether the worker 40 approaches another risk area, wherein the floors above the first floor 26, in particular the second floor 28, are only schematically adumbrated by the dashed lines. The elevator 20 comprises a pit 54 underneath the lowest floor, for example underneath the first floor 26. The worker 40 is already in the pit 54. The other risk area may be within the pit 54. Further, if the worker is in the pit 54, the car 22 may be a risk area, because the worker 40 may be smashed by the car 22 and/or because the worker 40 may hit his head against the bottom of the car 22. Therefore, a safety sensor 56 communicating with the controller 35 of the elevator 20 may be arranged in the pit 54. The safety sensor 56 may detect the presence of one or more of the safety devices 42, 44, 46 and may send the corresponding signal to the controller 35 of the elevator 20. Further, the one or more of the safety devices 42, 44, 46 may send the safety signal to the controller 35 of the elevator 22 to enable the controller 35 to check, whether the predetermined requirements regarding the pit 54 are fulfilled. In this context, the predetermined requirement may be that the worker 40 wears the helmet 42, that the helmet 42 is properly worn, and/or that the helmet 42 has not expired.

The dangerous device 52 may for example be a high voltage and/or high voltage current device, a counterweight of the car 22, another car 22 within the hoistway 24, a counterweight of the other car 22. If the worker 40, in particular the arm at which the wristband 46 is attached or the head on which the helmet 42 is placed, approaches the dangerous device 52 a corresponding sensor (not shown) may detect the wristband 46 and/or the helmet 42 and may send the corresponding warning signal to the worker 40. The warning signal may be an acoustical or optical signal, provided for example by the speaker and/or, respectively, a light source of the elevator 20 and/or at least one of the safety devices 42, 44, 46.

Further functionalities of the controller 35 of the elevator 20 are explained below with respect to figure 6 and further functionalities of the safety devices 42, 44, 46 are explained below with respect to figure 7.

Fig. 5 shows several safety devices communicating with a computer, according to an embodiment of the technology described herein, e.g. the safety devices 42, 44, 46 and computer 58. The safety devices 42, 44, 46 may widely correspond to the safety devices 42, 44, 46 as explained above. Therefore, only those features and functionalities of the safety devices 42, 44, 46 are explained in the following, which are different from the safety devices 42, 44, 46 described with respect to figures 1 to 4.

In figure 5, the safety devices 42, 44, 46, in particular the controllers (not shown) of the safety devices 42, 44, 46, may communicate with the computer 58. For example, the safety devices 42, 44, 46 each may send its ID and/or expiration date to the computer 58. The computer 58 may communicate with the controller 35 of the elevator 20 in order to provide the IDs and/or expiration dates of the safety devices 42, 44, 46 to the controller 35 of the elevator. Further, the lookup table, which assigns the predetermined requirements to the risk areas, may be updated and/or adapted in accordance with the IDs and/or expiration dates.

Fig. 6 shows a flow chart of a method for ensuring a safe maintenance of an elevator, e.g. of the elevator 20, according to an embodiment of the technology described herein. The method may be carried out by the controller 35 of the elevator 20.

In step S2, the safety signal from at least one of the safety devices 42, 44, 46 worn by a maintenance worker, e.g. worker 40, is received, e.g. by the controller 35 of the elevator 20, if the worker 40 wants to have access to one of the risk areas of the elevator 20. At least one safety-relevant information about the safety devices 42, 44, 46 is encoded in the safety signal. The safety signal may be broadcasted by the safety devices 42, 44, 46 continuously. Alternatively, the safety signal may be automatically received by the controller 35 of the elevator 20, if the worker 40 approaches one of the risk areas of the elevator 20. For example, the safety signal may be sent to the controller 35 in response to a request signal of the elevator 20, which may be generated automatically, if the worker 40 approaches one of the risk areas of the elevator 20. For example, a proximity sensor (not shown) of the elevator 20 may sense the safety devices 42, 44, 46, if the worker 40 wearing the safety devices 42, 44, 46 approaches one of the risk areas, and may send a corresponding signal to the controller 35 of the elevator 20. The controller 35 of the elevator 20 then may send the request signal to the safety devices 42, 44, 46 before granting access to the corresponding risk area.

In step S4, the safety-relevant information is decoded from the safety signal, e.g. by the controller 35 of the elevator 20. The safety-relevant information may be that the safety device 42, 44, 46 is worn by the worker 40. Alternatively or additionally, the safety relevant information may be the type of the safety device 42, 44, 46, in particular whether the safety device 42, 44, 46 is the helmet 42, the harness 44 or the wristband 46. Alternatively or additionally, the safety-relevant information may be that the safety device 42, 44, 46 is worn by the worker 40 correctly, e.g. if all fasteners of the corresponding safety device 42, 44, 46 are closed. Alternatively or additionally, the safety-relevant information may be that the safety device 42, 44, 46 is properly engaged to the safety means 48 of the elevator 20. Alternatively or additionally, the safety-relevant information may be the expiration date of the safety device 42, 44, 46. In step S6, it is determined, whether the safety devices 42, 44, 46 fulfill one or more of the predetermined requirements for accessing one of the risk areas of the elevator 20 from the safety-relevant information. The predetermined requirements may comprise that one or more of the safety devices 42, 44, 46 are worn by the worker 40. Alternatively or additionally, the predetermined requirements may comprise that one or more of the safety devices 42, 44, 46 are of the proper type of the safety devices 42, 44, 46 for accessing the corresponding risk area. Alternatively or additionally, the predetermined requirements may comprise that the safety devices 42, 44, 46 worn by the worker 40 are worn correctly. Alternatively or additionally, the predetermined requirements may comprise that one or more of the safety devices 42, 44, 46 are properly engaged to the safety means 48. Alternatively or additionally, the predetermined requirements may comprise that at least one of the safety devices 42, 44, 46 worn by the worker 40 has expired. So, each of the above safety-relevant information encoded in the safety signal corresponds to one of the predetermined requirements. In other words, each of the predetermined requirements may be checked by at least one of the safety-relevant information. If the predetermined requirement is fulfilled, the method proceeds in a step S8. If the predetermined requirement is not fulfilled, the method proceeds in a step S10.

In step S8, the access to the corresponding risk area is granted. Optionally, an access signal may be sent to the worker 40 in order to notify the worker 40 that the access to the risk area is granted. If necessary, an enable signal may be sent to another controller of the elevator 20, wherein the other controller is responsible for granting and denying access to the risk area and/or another risk area of the elevator 20.

In step S10, the access to the corresponding risk area is denied. Optionally, a denial signal may be sent to the worker 40 in order to notify the worker 40 that the access to the risk area is not granted. Optionally, the denial signal is representative for the reason why the access is not granted.

After granting or denying the access to the risk area, the method may be terminated.

Fig. 7 shows a flow chart of an embodiment of a method for ensuring a safe maintenance of an elevator, e.g. of the elevator 20, according to an embodiment of the technology described herein. The method may be carried out by the controller 35 of the elevator 20. The method may be implemented into the method explained with respect to figure 6. In other words, the steps of the method explained with respect to figure 7 may be additional steps of the method explained with respect to figure 6. Alternatively, the method according to figure 7 may be carried out separately. In any case, the method according to figure 7 may be carried out, if the worker 40 is already in one of the risk areas. The method may correspond to a monitoring of a position of the worker 40 relative to the elevator 20 after the worker 40 has accessed the risk area.

In step S20, the safety signal is received by the controller 35 of the elevator 20.

In step S22, it is determined whether the worker 40, in particular at least one of the safety devices 42, 44, 46, approaches another risk area, e.g. by decoding and/or analyzing the safety signal, e.g. by extracting the safety-relevant information from the safety signal. If the requirement of step S22 is fulfilled, the method proceeds in step S24. If the requirement of step S22 is not fulfilled, the method proceeds again in step S20.

In step S24, a warning signal may be sent to the worker 40. The warning signal informs the worker 40 that he approaches another risk area.

After sending the warning signal, the method may be terminated. Alternatively, the method may be carried continuously as long as the worker is in one of the risk areas.

Fig. 8 shows a flow chart of an embodiment of a method for ensuring a safe maintenance of an elevator, e.g. of the elevator 20, according to an embodiment of the technology described herein. The method may be carried out by a controller of one of the safety devices 42, 44, 46.

In step S30 at least one safety-relevant information regarding the corresponding safety device 42, 44, 46 is determined by the controller of the corresponding safety device 42, 44, 46. For example, the controller of the corresponding safety device 42, 44, 46 may determine the safety-relevant information by one or more sensors of the corresponding safety device 42, 44, 46. The sensors may check whether the worker 40 in fact wears the corresponding safety device 42, 44, 46, whether the worker wears the corresponding safety device 42, 44, 46 correctly, and/or whether the corresponding safety device 42, 44, 46 is properly engaged to the safety means 48 of the elevator 20, and may send a corresponding signal to the controller of the corresponding safety device 42, 44, 46. Alternatively or additionally, the controller of the corresponding safety device 42, 44, 46 may determine the safety-relevant information by loading the safety-relevant information from a memory of the corresponding safety device 42, 44, 46, wherein in this context the safety-relevant information may be the type and/or the expiration date of the corresponding safety device 42, 44, 46.

In step S32, the safety relevant information is encoded in the safety signal, e.g. by the controller of the corresponding safety device 42, 44, 46.

In step S34, the safety signal is sent from the corresponding safety device 42, 44, 46 to the controller 35 of the elevator 20.

Finally, it should be noted that the term “comprising” does not exclude other elements or steps and the “a” or “an” does not exclude a plurality. Also elements described in association with different embodiments may be combined. For example, one, two, three or all of the embodiments of the elevator 20 shown in figures 1 to 4 may be combined in or may be parts of the same elevator 20. Further, each of these embodiments of the elevators 20 may be combined with one, two or all of the above methods. Further, two or all of the above methods may be combined. For example, the method explained with respect to figure 7 may be implemented into the method explained with respect to figure 6. Alternatively or additionally, the methods explained with respect to figures 6 and 7 may combined with the method explained with respect to figure 8 in so far that the methods embody a communication between the controller 35 of the elevator 20 and one or more of the controllers of the safety devices 42, 44, 46. It should also be noted that reference signs in the claims should not be construed as limiting the scope of the claims.