An elevator system, comprising: an elevator car and a drive system configured to drive movement of the elevator car; an elevator controller, configured to control operation of the elevator car; a safety controller; and a plurality of safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141) connected to the safety controller, wherein the plurality of safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141) monitor the elevator system; wherein the safety controller is configured to receive a signal in response to a change of state of any of the safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141); wherein, after receiving a signal in response to a change of state of one or more of the safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141), the safety controller determines a condition of the elevator system; wherein if the safety controller renders a determination that the elevator system is in a first condition, the safety controller causes an elevator brake to be deployed, preventing movement of the elevator car; wherein if the safety controller renders a determination that the elevator system is in a second condition, the safety controller allows movement of the elevator car for a predetermined duration or until the elevator car has travelled a predetermined distance; and wherein the safety controller is arranged to move the elevator car to the nearest landing upon rendering a determination that the elevator system is in the second condition; characterised in that: the elevator system comprises an inspection operation control box located on the roof of the elevator car; and in that the safety controller is arranged to move the elevator car in response to commands input through a user interface of the inspection operation control box. an elevator car and a drive system configured to drive movement of the elevator car; an elevator controller, configured to control operation of the elevator car; a safety controller; and a plurality of safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141) connected to the safety controller, wherein the plurality of safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141) monitor the elevator system; wherein the safety controller is configured to receive a signal in response to a change of state of any of the safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141); wherein, after receiving a signal in response to a change of state of one or more of the safety devices (126a, 126b, 127, 129, 131, 138a, 138b, 140, 141), the safety controller determines a condition of the elevator system; wherein if the safety controller renders a determination that the elevator system is in a first condition, the safety controller causes an elevator brake to be deployed, preventing movement of the elevator car; wherein if the safety controller renders a determination that the elevator system is in a second condition, the safety controller allows movement of the elevator car for a predetermined duration or until the elevator car has travelled a predetermined distance; and wherein the safety controller is arranged to move the elevator car to the nearest landing upon rendering a determination that the elevator system is in the second condition; characterised in that: the elevator system comprises an inspection operation control box located on the roof of the elevator car; and in that the safety controller is arranged to move the elevator car in response to commands input through a user interface of the inspection operation control box. the elevator system comprises an inspection operation control box located on the roof of the elevator car; and in that the safety controller is arranged to move the elevator car in response to commands input through a user interface of the inspection operation control box.