Patent Description:
With the continuous development of industrial control technology, the application scope of devices with self-capacities (such as mobile robots) has been greatly expanded. Within tall buildings, there is a need to provide ride services for these devices. But this may pose a security risk. For example, if people share an elevator with a robot performing epidemic prevention operations, they may be infected by a virus or bacteria. For another example, some devices are equipped with large-capacity batteries, once the devices fire and explode, it will cause great harm to the colleagues. Therefore, corresponding safety measures have been formulated, including prohibiting people from sharing elevators with dangerous devices. <CIT> discloses a control method and system for an elevator. The control system is arranged outside an original elevator control system and is isolated from the elevator control system. <CIT> discloses an elevator dispatching method and device. By using this method, elevators can be dispatched so that robots can automatically enter, exit and ride the elevators in the building.

According to one aspect of the present application, there is provided an elevator controller, comprising:.

Optionally, the computer system is a cloud platform or a server.

Optionally, the identification of the target device is an international mobile user identification number associated with a user identification module set on the target device.

In addition to the above-mentioned one or more features, in the above-mentioned elevator controller, the elevator reservation message also includes a designation of an elevator operation mode and an identification of an arrival floor, and the running of the computer program causes step A to include:.

In addition to the above-mentioned one or more features, in the above-mentioned elevator controller, the running of the computer program causes step B to include:.

Optionally, in the above-mentioned elevator controller, the set conditions further includes that there is no passenger in the car, and the running of the computer program causes step C to include:.

In addition to the above-mentioned one or more features, in the above-mentioned elevator controller, the running of the computer program causes step B to include:
B1'. sending a message indicating that the dispatch command has been generated to the computer system, so that the computer system generates a password associated with the target device and sends a confirmation message containing the password to the target device, the password is generated based on at least one of the following items: an identification of the target device and a timing signal.

In addition to the above-mentioned one or more features, in the above-mentioned elevator controller, the running of the computer program causes step B to include:
B1". sending a message indicating that the dispatch command has been generated to the computer system, so that the computer system generates a password associated with the target device, sends a confirmation message containing the password to the target device, and sends the password to the elevator controller, the password is generated based on at least one of the following items: a random number, an identification of the target device and a timing signal.

In addition to the above-mentioned one or more features, in the above-mentioned elevator controller, the running of the computer program also causes:.

According to another aspect of the present application, there is provided a method for providing elevator services for a target device with self-propelled capability, comprising the following steps performed by an elevator controller:.

In addition to the above mentioned one or more features, in the above-mentioned method, the computer system is a cloud platform or a server.

In addition to the above mentioned one or more features, in the above-mentioned method, the identification of the target device is an international mobile user identification number associated with a user identification module set on the target device.

In addition to the above mentioned one or more features, in the above-mentioned method, the elevator reservation message also includes a designation of an elevator operation mode and an identification of an arrival floor, and step A includes:.

In addition to the above mentioned one or more features, in the above-mentioned method, step B includes:.

In addition to the above mentioned one or more features, in the above-mentioned method, the set conditions further includes that there is no passenger in the car, and step C includes:.

In addition to the above mentioned one or more features, in the above-mentioned method, step B includes:
B1'. sending a message indicating that the dispatch command has been generated to the computer system, so that the computer system generates the password associated with the target device and sends a confirmation message containing the password to the target device, the password is generated based on at least one of the following items: an identification of the target device and a timing signal.

In addition to the above mentioned one or more features, in the above-mentioned method, step B includes:
B1". sending a message indicating that the dispatch command has been generated to the computer system, so that the computer system generates a password associated with the target device, sends a confirmation message containing the password to the target device, and sends the password to the elevator controller, the password is generated based on at least one of the following items: a random number, an identification of the target device and a timing signal.

In addition to the above mentioned one or more features, in the above-mentioned method, further comprising the steps of:.

According to another aspect of the present application, there is provided a computer-readable storage medium having instructions stored in the computer-readable storage medium, when the instructions are executed by a processor, the processor is caused to execute any of the above methods.

According to another aspect of the present application, there is provided a computer system, comprising:.

In addition to the above mentioned one or more features, in the above-mentioned computer system, the identification of the target device is an international mobile user identification number associated with a user identification module set on the target device, and the first computer system sends the generated confirmation message to the target device via <NUM> or <NUM> mobile communication network.

In addition to the above mentioned one or more features, in the above-mentioned computer system, the target device is one of the following: disinfection operation robots, dangerous goods monitoring operation robots, dangerous goods transporting operation robots, and device equipped with high-density energy storage units.

In addition to the above mentioned one or more features, in the above-mentioned computer system, the elevator reservation message also includes a designation of an elevator operation mode and an identification of an arrival floor.

In addition to the above mentioned one or more features, in the above-mentioned computer system, the running of the computer program causes step C to include:.

In addition to the above mentioned one or more features, in the above-mentioned computer system, the running of the computer program causes step C to further include:
C3': sending the generated password to the elevator controller.

According to another aspect of the present application, there is provided a method for providing elevator services for a target device with self-propelled capability, comprising the following steps performed by a first computer system:.

In addition to the above mentioned one or more features, in the above-mentioned method, the identification of the target device is an international mobile user identification number associated with a user identification module set on the target device, and the first computer system sends the generated confirmation message to the target device via <NUM> or <NUM> mobile communication network.

In addition to the above mentioned one or more features, in the above-mentioned method, the elevator reservation message also includes a designation of an elevator operation mode and an identification of an arrival floor.

In addition to the above mentioned one or more features, in the above-mentioned method, step C includes:.

In addition to the above mentioned one or more features, in the above-mentioned method, step C further includes:
C3': sending the generated password to the elevator controller.

The above and/or other aspects and advantages of the present application will be more clearly and easily understood from the following description of various aspects in conjunction with the accompanying drawings, in which the same or similar elements are designated by the same reference numerals. The accompanying drawings include:.

The present application is described more fully below with reference to the accompanying drawings, in which illustrative embodiments of the application are illustrated. However, the present application may be implemented in different forms and should not be construed as limited to the embodiments presented herein. The presented embodiments are intended to make the disclosure herein comprehensive and complete, so as to more comprehensively convey the protection scope of the application to those skilled in the art.

In this specification, terms such as "comprising" and "including" mean that in addition to units and steps that are directly and clearly stated in the specification and claims, the technical solution of this application does not exclude the presence of other units and steps that are not directly and clearly stated in the specification and claims.

Unless otherwise specified, terms such as "first" and "second" do not indicate the order of the units in terms of time, space, size, etc., but are merely used to distinguish the units.

In some embodiments of the present application, when a computer system coupled to an elevator controller (such as a cloud platform or server maintained and operated by elevator manufacturers and property service providers) receives an elevator ride request associated with a target device with self-propelled capability from other computer systems (such as a cloud platform or server maintained and operated by special operation service providers or logistics service providers), it generates a corresponding elevator reservation message based on the elevator ride request and sends the elevator reservation message to the elevator controller. Then, the elevator controller determines whether the target device specified in the elevator reservation message has the authority to use the requested elevator service, and generates a control command for dispatching the elevator to stop to the departure floor after the device has the corresponding authority. Examples of the target device described here include, but are not limited to, transport robots, disinfection operation robots, dangerous goods monitoring operation robots, dangerous goods transporting operation robots, and device equipped with high-density energy storage units.

In some embodiments of the present application, the elevator ride request and elevator reservation messages may include an identification of the target device and an identification of the departure floor of the target device. In addition, the elevator reservation message may also include a designation of an elevator operation mode.

In some embodiments of the present application, after the elevator stops at the departure floor of the device and before starting the elevator, it will be determined whether a state of the car satisfies set conditions. The above set conditions at least include: i) the device indicated by the elevator reservation message is located in the car or the device in the car has passed identity authentication. Optionally, the set conditions may further include: ii) there is no passenger in the car. When the set conditions are satisfied, the elevator controller will start the elevator. Optionally, when the elevator reservation message contains the designation of the elevator operation mode, after satisfying the set conditions, the elevator controller will start the elevator to enter the designated mode. Optionally, presence of the passenger may be determined using images or videos of the interior of the car captured by an image sensor, and the images or videos may be acquired using an image sensor arranged in the car.

On the other hand, if the set conditions are not satisfied, the elevator controller will prohibit the starting of the elevator. Optionally, the elevator controller can also instruct the car controller to display prompt message through a display device (eg, an LED display device) in the car or play a prompt voice through a sound output device (eg, a speaker) to prompt passengers to leave the car. In another optional manner, the elevator controller instructs the car controller to send a message that the identity authentication fails to the device in the car. Optionally, when the set conditions are not satisfied, the elevator controller will generate a dispatch command for the elevator reservation message again.

Optionally, the elevator controller is configured to generate a warning message to prompt a user, such as a building administrator, when the number of occurrences of events that do not satisfy the set conditions is greater than a predetermined threshold.

In some embodiments of the present application, after the dispatch command is generated, a confirmation message may be sent to the target device specified in the elevator reservation message, where the confirmation message includes a password for identity authentication of the target device. For example, identity authentication is performed by comparing the password in the confirmation message with the password received from the device in the car. if the two match, it is determined that the target device indicated by the elevator reservation message is located in the car; otherwise, it is determined that the identity authentication has not been passed. The identity authentication mechanism can prevent unauthorized devices from taking the elevator, which is particularly advantageous in some application scenarios. For example, for safety reasons, it is necessary to carry out stricter management on dangerous goods transporting operation robots, so it is particularly necessary to prevent such device from using the identity of other device to take the elevator.

In some embodiments of the present application, the confirmation message is sent by a computer system coupled to the elevator controller (such as a cloud platform or remote server maintained and operated by elevator manufacturers). Typically, the computer system described above is capable of communicating with multiple elevator controllers and target devices within a larger geographic area (eg, an entire city or multiple neighborhoods, or even multiple cities), so sending a confirmation message via the computer system is conducive to improving the efficiency of communication and operation management.

When the communication between the computer system and the target device is via a <NUM> or <NUM> mobile communication network, it is usually necessary to set a user identification module (such as a SIM card and a USIM card) on the target device. Optionally, in this case, an international mobile user identification number associated with the user identification module can be used as the identification of the target device. Because of the uniqueness of the international mobile user identification number, it is advantageous to use it as device identification. In addition, the user identification module provides a safe and reliable user identity authentication mechanism to prevent the identity of the device from being falsely used and the user data transmitted on the wireless channel from being stolen (that is, to prevent the phenomenon of "number theft and machine merging"), which helps to realize the aforementioned need to prevent unauthorized devices from taking the elevator through the identity authentication mechanism.

Optionally, the password may be generated by the elevator controller and included in the confirmation message sent to the target device. Optionally, the password may be generated by the computer system described above and included in the confirmation message sent to the target device. In order to realize the identity authentication based on the password at the elevator controller, optionally, the computer system can send the generated password to the elevator controller; or alternatively, the generation algorithm of the password is shared between the computer system and the elevator controller, that is, the computer system and the elevator controller use the corresponding or the same algorithm to generate the password, so the elevator controller can perform identity authentication using the password generated locally.

Optionally, the password can be generated based on at least one of the following items: a random number, the identification of the target device (such as an international mobile user identification number) and a timing signal (such as time service information sent by mobile communication network or synchronization signal between the computer system and elevator controller, etc.).

In some embodiments of the present application, while generating the dispatch command, the elevator controller may also instruct a call unit or an outbound call control unit associated with the departure floor (for example, the call unit or the outbound call control unit located on the departure floor) to display prompt message on its display module (such as LED display device) or play prompt voice through sound output device (such as speaker) to remind passengers not to take the currently stopped elevator.

In some embodiments of the present application, the elevator controller is configured to provide a high level of administrative rights, enabling a user, such as a building administrator, to decide whether to reject all elevator reservation messages or specific elevator reservation messages (for example, under the designated elevator operation mode, device with specific identification, etc.). Illustratively, the above configuration enables a building administrator to stop providing elevator service to device during an emergency or high traffic flow.

<FIG> is a schematic diagram of an elevator service provision process according to some embodiments of the present application.

In <FIG>, the elevator service provision process is illustrated from the perspective of multiple participants. The participants involved in this process include an elevator controller or elevator control cabinet <NUM>, a first computer system <NUM> (eg, a cloud platform of elevator manufacturers or property service providers), a second computer system <NUM> (eg, a cloud platform of logistics service providers), a target device <NUM> with self-propelled capability (eg, a mobile robot that completes various operations), a call unit or an outbound call control unit <NUM>, a car controller <NUM>, etc. The elevator service provision process shown in <FIG> includes the following steps:.

In step S104, the elevator controller <NUM> also generates a password associated with the target device <NUM>. As described above, the password may be generated based on at least one of the following items: a random number, an identification of the target device and a timing signal.

Illustratively, a list of devices permitted to use elevator services may be stored in elevator controller <NUM> locally or external storage device independent of elevator controller <NUM>, the list includes the identification of the permitted device and the category of permitted elevator operation modes (when there are multiple elevator operation modes). Therefore, the elevator controller <NUM> can determine whether the device indicated by the elevator reservation message has the authority to use the elevator service by looking up the table according to the device identification in the elevator reservation message, or when the elevator reservation message contains the designation of the elevator operation mode, determine whether the device indicated by the elevator reservation message has the authority to use the elevator service in the designated elevator operation mode by looking up the table. If it is determined to have the corresponding authority, a dispatch command including the departure floor where the elevator stops can be generated, so that under the control of the elevator controller <NUM>, the elevator is directed to the departure floor where the device is located; otherwise, a feedback message for rejecting the elevator reservation message is generated.

Optionally, when the designated elevator operation mode allows multiple devices to be carried at the same time, in addition to determining the use authority, the elevator controller <NUM> also determines whether the elevator car can accommodate the device indicated by the elevator reservation message. When it is determined that there are corresponding authority and accommodation space, the dispatch command is generated; otherwise, a feedback message is generated that rejects the elevator reservation message. Exemplarily, if the indicated device is a dangerous goods transporting operation robot and the carrying capacity of the car is <NUM> such devices, it will be determined that the car meets the requirements of accommodation space when the car has carried <NUM> devices, and it will be determined that the car does not meet the requirements of accommodation space when the car has carried <NUM> devices; for another example, although the number of devices currently carried by the car is <NUM>, if the dispatch command to call the current elevator has been generated for the previous elevator reservation message (assuming that the indicated device is also a dangerous goods transporting operation robot), it will still be determined that the car does not meet the requirements of accommodation space.

In step S104, optionally, the elevator controller <NUM> may also generate a command instructing the call unit <NUM> of the departure floor to present a prompt message not to take the currently stopped elevator.

S105: The elevator controller <NUM> sends to the first computer system <NUM> a message that a dispatch command has been generated or a message that the elevator reservation message has been rejected. Optionally, the password generated in step S104 may be included in the message that the dispatch command has been generated.

S105a: The elevator controller <NUM> may also send a command to present prompt message to the call unit <NUM> of the departure floor.

S106: The first computer system <NUM> generates a confirmation message including the password associated with the target device <NUM> sent by the elevator controller <NUM> in step S105.

S107: The first computer system <NUM> sends the generated confirmation message to the target device <NUM>.

S108: After the elevator stops at the departure floor, the car controller <NUM> transmits the password received from the device located in the car to the elevator controller <NUM>, which can be received by the wireless signal transceiver device (such as Bluetooth module, WiFi module, etc.) inside the car. Optionally, the car controller <NUM> may also transmit images or videos inside the car to the elevator controller <NUM>, which may be acquired by an image sensor arranged in the car.

S109: The elevator controller <NUM> determines whether set conditions are satisfied according to the data (eg, a password, images or videos) received from the car controller <NUM>. The above set conditions at least include: i) the identity authentication of the device in the car based on the password has passed. Optionally, the set conditions may further include: ii) there is no passenger in the car. When the set conditions are satisfied, the elevator controller <NUM> starts the elevator (eg, enters the operation mode specified by the elevator reservation message). On the other hand, if the set conditions are not satisfied, the elevator controller <NUM> prohibits the starting of the elevator.

In this step, optionally, the elevator controller <NUM> will generate a dispatch command again for the target device indicated by the elevator reservation message. In addition, optionally, the elevator controller <NUM> may also generate a control command about the car controller, instructing the car controller <NUM> to present the prompt message of leaving the car to passengers in the car or send the prompt message of leaving the car to the device in the car.

S110: The elevator controller <NUM> sends the generated control command to the car controller <NUM>.

Sill: The car controller <NUM> presents the prompt message of leaving the car to the passengers in the car or sends the prompt message of leaving the car to the device in the car.

<FIG> is a schematic diagram of an elevator service provision process according to other embodiments of the present application.

In <FIG>, the elevator service provision process is also illustrated from the perspective of multiple participants. The participants involved in this process include an elevator controller or elevator control cabinet <NUM>, a first computer system <NUM> (eg, a cloud platform of elevator manufacturers or property service providers), a second computer system <NUM> (eg, a cloud platform of logistics service providers), a target device <NUM> with self-propelled capability (eg, a mobile robot that completes various operations), a call unit or an outbound call control unit <NUM>, a car controller <NUM>, etc..

In the elevator service provision process shown in <FIG>, steps S201-<NUM> are respectively similar to steps S101-S103 in <FIG>, and steps S205, S207, <NUM>-<NUM> are respectively similar to steps S105, S107, <NUM>-<NUM> in <FIG>, but steps S204 and <NUM> are different from steps S104 and S106, and step S207a is added between steps S207 and <NUM>. To avoid repetition, only the differences are described below.

S204: Compared with step S104, in this step, the elevator controller <NUM> generates a dispatch command for stopping the elevator to the departure floor according to the received elevator reservation message, but does not generate a password associated with the target device <NUM>. Besides, this step may have various features of step S104. S206: Compared with step S106, in this step, the first computer system <NUM> generates a password associated with the target device <NUM> and sends the target device <NUM> a confirmation message containing the generated password.

S207a: The first computer system <NUM> sends the password generated in step S206 to the elevator controller <NUM>.

In the elevator service provision process shown in <FIG>, steps S301-<NUM> are similar to steps S201-S211 in <FIG>, respectively, and the main difference from the process shown in <FIG> is that in the process shown in <FIG>, step S207a is omitted, but step S309a is added between steps S308 and <NUM>. To avoid repetition, only the differences are described below.

S309a: The elevator controller <NUM> uses the corresponding algorithm or the same algorithm used in step <NUM> to generate a password associated with the target device <NUM>.

<FIG> is a schematic diagram of an elevator service provision process according to other embodiments of the present application. The process shown in <FIG> is executed at an elevator controller (eg, elevator controller <NUM> in <FIG>) and includes the following steps:.

In step S402, the conditions for determining whether to allow include but are not limited to one or more of the following:.

S403: The elevator controller generates a corresponding dispatch command, and the command includes the identification of the departure floor of the device. Optionally, the command may also include the identification of an arrival floor.

In step S403, optionally, the elevator controller also generates a password associated with the target device or a command instructing the call unit of the departure floor to present a prompt message to passengers not to take the currently stopped elevator.

S404: The elevator controller generates a feedback message for rejecting the elevator reservation message.

The flow shown in <FIG> proceeds to step S405 after steps S403 and S404.

S405: The elevator controller sends a message that the dispatch command has been generated or a message that the elevator reservation message has been rejected to the computer processing system as the sender of the elevator reservation message. Optionally, the message that the dispatch command has been generated may include a password associated with the target device. Optionally, the elevator controller may also send a command to present prompt message to the call unit of the departure floor.

S406: The elevator controller receives the password of the device located in the car from the car controller, the password is sent by the target device and received by the wireless signal transceiver device (such as a Bluetooth module, a WiFi module, etc.) inside the car. Optionally, the elevator controller also receives images or videos inside the car from the car controller, and these images and videos can be acquired by image sensors arranged in the car.

S407: The elevator controller determines whether the set conditions are satisfied according to the data (eg, images or videos and password, etc.) received from the car controller. The set conditions and determination methods have been described in detail above, and will not be repeated here. In step S407, if it is determined that the set conditions are satisfied, go to step S408, otherwise go to step S409.

S408: The elevator controller starts the elevator (eg, enters the operation mode specified by the elevator reservation message).

S409: The elevator controller prohibits the elevator from starting. Optionally, the elevator controller counts the number of occurrences of events that do not satisfy the set conditions, and generates a warning message when the count value is greater than a predetermined threshold.

S410: The elevator controller sends a command to the car controller to instruct the car controller to present the prompt message of leaving the car to passengers in the car, or instruct the car controller to send the prompt message of leaving the car to the device in the car.

Optionally, the flow shown in <FIG> returns to step S402 after step S410, generating a dispatch command again for the device indicated by the elevator reservation message.

It should be pointed out that, the execution sequence of the operations of counting the number of events occurring and generating the warning message in step S409 in <FIG> is merely an example and not a limitation. These operations may be performed during, before or after any of steps S401-S410.

In addition, the flow shown in <FIG> may also include the step of receiving a setting from a user such as a building administrator to reject all elevator reservation messages or elevator reservation messages with characteristics specified by the user input. This step may be performed before or after steps S401-S410.

In step S403, an operation of generating a password associated with the target device by the elevator controller is not necessary. In some variant embodiments, in step S403, the elevator controller generates a corresponding dispatch command but does not generate a password. Correspondingly, in step S407, the password for performing identity authentication may be a password received from the computer system, or may also be a password generated using an algorithm corresponding to or identical to the computer system.

<FIG> is a schematic block diagram of a typical elevator controller.

As shown in <FIG>, elevator controller <NUM> includes communication unit <NUM>, memory <NUM> (eg, non-volatile memory such as flash memory, ROM, hard drive, magnetic disk, optical disk, etc.), processor <NUM> and a computer program <NUM> stored on the memory <NUM> and operable on the processor <NUM>.

The communication unit <NUM> serves as a communication interface and is configured to establish a communication connection between the elevator controller and an external device or network (eg, computer system, call unit, and car controller, etc.). The memory <NUM> stores a computer program <NUM> executable by the processor <NUM>. The processor <NUM> is configured to execute the computer program <NUM> to implement the elevator service provision process shown in <FIG>.

<FIG> is a schematic diagram of an elevator service provision process according to other embodiments of the present application. The process shown in <FIG> is performed at a computer system (eg, the first computer system <NUM> in <FIG>) and includes the following steps:.

<FIG> is a schematic diagram of an elevator service provision process according to other embodiments of the present application. The process shown in <FIG> is performed at a computer system (eg, the first computer system <NUM> in <FIG>). Steps <NUM>-<NUM> and S707 in <FIG> correspond to steps S601-S603 and S606 in <FIG> respectively. To avoid repetition, only the differences between the embodiment shown in <FIG> and the embodiment shown in <FIG> are described below:.

<FIG> is a schematic block diagram of a typical computer system.

As shown in <FIG>, computer system <NUM> includes communication unit <NUM>, memory <NUM> (eg, non-volatile memory such as flash memory, ROM, hard drive, magnetic disk, optical disk, etc.), processor <NUM> and a computer program <NUM> stored on the memory <NUM> and operable on the processor <NUM>.

The communication unit <NUM> serves as a communication interface and is configured to establish a communication connection between the computer system and an external device or network (eg, elevator control and other computer systems, etc.). The memory <NUM> stores a computer program <NUM> executable by the processor <NUM>. The processor <NUM> is configured to execute the computer program <NUM> to implement the elevator service provision process shown in <FIG> and <FIG>.

According to another aspect of the present application, there is also provided a computer-readable storage medium on which a computer program is stored, when the program is executed by the processor, one or more steps contained in the flow described above with the help of <FIG>, <FIG> and <FIG> can be realized.

The computer-readable storage medium referred to in the application includes various types of computer storage media, and may be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, the computer-readable storage medium may include RAM, ROM, EPROM, E2PROM, registers, hard disks, removable disks, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other transitory or non-transitory medium that can be used to carry or store a desired program code unit in the form of instructions or data structures and that can be accessed by a general-purpose or special-purpose computer or a general-purpose or special-purpose processor. Disks as used herein usually copy data magnetically, while discs use lasers to optically copy data. The above combination should also be included in the protection scope of the computer-readable storage medium. An exemplary storage medium is coupled to the processor such that the processor can read and write information from and to the storage medium. In the alternative, the storage medium may be integrated into the processor. The processor and the storage medium may reside in the ASIC. The ASIC may reside in the user terminal. In the alternative, the processor and the storage medium may reside as discrete components in the user terminal.

Those skilled in the art will appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described herein can be implemented as electronic hardware, computer software, or combinations of both.

To demonstrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented in hardware or software depends on the particular application and design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in varying ways for the particular application. However, such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

Claim 1:
An elevator controller (<NUM>), comprising:
memory (<NUM>);
processor (<NUM>); and
a computer program (<NUM>) stored on the memory (<NUM>) and running on the processor (<NUM>), the running of the computer program (<NUM>) causes:
A. generating a dispatch command for stopping an elevator car to a departure floor of a target device (<NUM>) with self-propelled capability in response to an elevator reservation message from a computer system (<NUM>), wherein the elevator reservation message includes an identification of the target device (<NUM>) and an identification of the departure floor;
B. instructing the computer system (<NUM>) to send a confirmation message to the target device (<NUM>), the confirmation message includes a password associated with the target device (<NUM>);
C. after the elevator stops at the departure floor of the target device (<NUM>) and before starting the elevator, determining whether a state of the car satisfies one or more set conditions, wherein the set conditions at least include: an identity authentication of the device in the car based on the password has passed; and
D. if the set conditions are satisfied, the elevator is started; otherwise, the elevator is prohibited from starting.