An elevator system , comprising: an elevator car and a drive system configured to drive movement of the elevator car ; an elevator controller , configured to control operation of the elevator car ; a safety controller ; and a plurality of safety devices connected to the safety controller , wherein the plurality of safety devices monitor the elevator system ; wherein the safety controller is configured to receive a signal in response to a change of state of any of the safety devices ; wherein, after receiving a signal in response to a change of state of one or more of the safety devices , the safety controller determines a condition of the elevator system ; wherein if the safety controller renders a determination that the elevator system is in a first condition, the safety controller causes an elevator brake to be deployed, preventing movement of the elevator car ; wherein if the safety controller renders a determination that the elevator system is in a second condition, the safety controller allows movement of the elevator car for a predetermined duration or until the elevator car has travelled a predetermined distance; and wherein the safety controller is arranged to move the elevator car to the nearest landing upon rendering a determination that the elevator system is in the second condition; characterised in that : the elevator system comprises an inspection operation control box located on the roof of the elevator car ; and in that the safety controller is arranged to move the elevator car in response to commands input through a user interface of the inspection operation control box . an elevator car and a drive system configured to drive movement of the elevator car ; an elevator controller , configured to control operation of the elevator car ; a safety controller ; and a plurality of safety devices connected to the safety controller , wherein the plurality of safety devices monitor the elevator system ; wherein the safety controller is configured to receive a signal in response to a change of state of any of the safety devices ; wherein, after receiving a signal in response to a change of state of one or more of the safety devices , the safety controller determines a condition of the elevator system ; wherein if the safety controller renders a determination that the elevator system is in a first condition, the safety controller causes an elevator brake to be deployed, preventing movement of the elevator car ; wherein if the safety controller renders a determination that the elevator system is in a second condition, the safety controller allows movement of the elevator car for a predetermined duration or until the elevator car has travelled a predetermined distance; and wherein the safety controller is arranged to move the elevator car to the nearest landing upon rendering a determination that the elevator system is in the second condition; characterised in that : the elevator system comprises an inspection operation control box located on the roof of the elevator car ; and in that the safety controller is arranged to move the elevator car in response to commands input through a user interface of the inspection operation control box . the elevator system comprises an inspection operation control box located on the roof of the elevator car ; and in that the safety controller is arranged to move the elevator car in response to commands input through a user interface of the inspection operation control box . <EOS>