Method for testing configuration of safety device of elevator system

Abstract

The invention relates to a method for testing a configuration of a safety device (8) of an elevator system (1), comprising: switching the safety device (8), which is configured to trigger a safety function when an actual value of a safety-critical operating parameter of the elevator system (1) exceeds a trigger threshold value (A), into a test mode for testing the configuration of the safety device, by switching to the test mode, the safety device (8) is configured to use a test threshold value (13), which is different from the operating threshold value (12), as the trigger threshold value (A), rather than the operating threshold value (12) used by the safety device (8) as the trigger threshold value (A) during normal operation of the elevator system (1).

Description

Field of the Invention

[0001] The present invention relates to a method for configuring a safety device for testing an elevator installation. Furthermore, the present invention relates to a data processing device, a computer program, and a computer-readable medium for performing the method. The present invention also relates to a safety device suitable for use in the method and to an elevator installation. Background Art

[0002] An elevator installation, such as may be used for transporting persons and / or goods in a building, is typically equipped with a safety device which can monitor one or more operating parameters, such as the traveling speed or deceleration of the car at the end of the shaft, and which automatically triggers one or more safety functions when the actual value of a corresponding operating parameter exceeds a certain trigger threshold. The elevator installation is then usually brought into a safe state by opening the safety circuit. The trigger threshold is usually higher than the permitted maximum value of the corresponding operating parameter. For example, the trigger threshold may be 110% of the permitted maximum value.

[0003] Certain settings associated with such safety functions need to be adapted on site, for example during commissioning. To this end, a technician can obtain from the elevator controller certain permitted maximum values for safety-critical operating parameters and determine the trigger thresholds adapted to the respective elevator installation by adding a certain margin to each maximum value. Here, errors can easily occur. The safety device adapted in this way can then be tested by performing a test run, in which the elevator installation runs in a manner different from normal operation, for example at an increased operating speed, in order to deliberately trigger the safety functions and thus check whether the settings have been adapted correctly. However, this can place a heavy burden on the elevator installation.

[0004] EP1510492A1 describes an example of a method for inspecting an elevator installation. Summary of the Invention

[0005] Consequently, there is a need for a method which enables excessive loading of the elevator installation to be avoided when testing safety functions during a test run.

[0006] Furthermore, there is a need for a corresponding data processing device, a corresponding safety device, a corresponding elevator installation, a corresponding computer program, and a corresponding computer-readable medium.

[0007] These needs can be met by the subject matter of the independent claims. Advantageous embodiments are set forth in the dependent claims, the following description, and the drawings.

[0008] A first aspect of the present invention relates to a method for testing the configuration of a safety device of an elevator installation, the elevator installation including a car that can travel between a plurality of floors of a building. The safety device is configured to trigger a safety function when an actual value of a safety-critical operating parameter of the elevator installation exceeds a triggering threshold. The method includes switching the safety device to a test mode for testing the configuration of the safety device. By switching the safety device to the test mode, the safety device is configured to use a test threshold different from an operating threshold as the triggering threshold instead of using the operating threshold that is used as the triggering threshold by the safety device during normal operation of the elevator installation.

[0009] The method can be implemented by a computer and automatically executed by a processor, such as a processor of the safety device or a (superordinate) elevator controller.

[0010] The expression "exceed" can also be understood as below. In other words, the triggering threshold can be exceeded in different directions.

[0011] Preferably, the triggering threshold is reduced to the test threshold by activating the test mode, such that when the elevator installation is under normal operating conditions, e.g., running at a normal travel speed and / or normal deceleration, the safety function has been triggered (e.g., by opening a switch in a safety circuit). Thereby, an excessive load on the elevator installation during a test run when testing the configuration of the safety device can be avoided.

[0012] When traveling with the test mode deactivated, the safety function is triggered only when the operating conditions are abnormal for some reason, e.g., when the travel speed is significantly higher than the speed under normal operating conditions, i.e., significantly higher than the permitted maximum travel speed.

[0013] The test threshold can be fixedly set. For example, the test threshold can be read from a write-protected memory (see also below). The effect is that the user cannot change the test threshold, or can change the test threshold only with considerable effort and / or after demonstrating authorization. In addition, there is no longer a need to manually set the triggering threshold on-site, which is generally much more complex than simply switching the safety device to a test mode with a pre-configured triggering threshold or pre-configured triggering thresholds.

[0014] The test threshold can be, for example, an empirical value, determined in experiments, calculated based on known parameters, or determined by computer simulation or computer modeling.

[0015] The process of switching to the test mode preferably occurs in response to the receipt of a corresponding command. The command can be input by a user. In other words, the test mode can be manually activated. However, it is also conceivable that the command can be automatically generated (and thus the test mode can be automatically activated), e.g., within the scope of a test method for testing an elevator installation executed by a computer.

[0016] A second aspect of the present invention relates to a data processing device having a processor configured to execute the method introduced in the context. The data processing device may include hardware modules and / or software modules. In addition to the processor, the data processing device may further include a memory and a data communication interface for wireless and / or wired data communication with peripheral devices.

[0017] The data processing device may, for example, be a component of the safety device introduced in the context. The data processing device may also be a component of a control device (also referred to as an elevator controller) for controlling an elevator device.

[0018] It should be noted that: the features of the method introduced in the context may also be features of the data processing device (and vice versa).

[0019] A third aspect of the present invention relates to a safety device for the method introduced in the context. The safety device is configured to trigger a safety function of an elevator device when an actual value of a safety-critical operating parameter of the elevator device exceeds a trigger threshold. In addition, the safety device can be switched to a test mode to test the configuration of the safety device, wherein, in the test mode, the safety device is configured to use a test threshold different from the operating threshold as the trigger threshold instead of using the operating threshold that is used as the trigger threshold by the safety device during normal operation of the elevator device.

[0020] The safety device may further include one or more sensors for detecting the actual value. Such sensors may be, for example, position sensors, displacement sensors, speed sensors, acceleration sensors, incremental detectors, absolute value detectors, or a combination of at least two of these examples.

[0021] The safety device may be configured to disconnect one or more switches of a safety circuit of the elevator device when the safety function is triggered, and thus interrupt the power supply to the drive device of the elevator device. Here, the braking device of the elevator device can be (automatically) activated, thereby stopping and / or holding the (one or more) carriages of the elevator device.

[0022] The safety device may be designed, for example, as an (electronic) speed limiter.

[0023] It should be noted that: the features of the method introduced in the context may also be features of the safety device (and vice versa).

[0024] A fourth aspect of the present invention relates to an elevator device. The elevator device includes a shaft connecting a plurality of floors of a building, a carriage movable between the floors in the shaft, a drive device for driving the carriage, the data processing device introduced in the context, and the safety device introduced in the context.

[0025] The drive device may for example include an electric drive and / or a hydraulic drive. The drive device may also include a braking device for braking the car and / or for keeping the car stationary.

[0026] Other aspects of the invention relate to a computer program and a computer-readable medium on which the computer program is stored.

[0027] The computer program includes instructions which, when the computer program is executed by a processor, cause the processor to perform the method described in the context introduction.

[0028] The computer-readable medium can be a volatile or non-volatile data memory. For example, the computer-readable medium can be a hard disk, a USB (Universal Serial Bus) memory, a RAM (Random Access Memory), a ROM (Read-Only Memory), a PROM (Programmable Read-Only Memory), an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), a flash memory, or a combination of two or more of these examples. The computer-readable medium can also be a data communication network capable of downloading program code (for example, via the Internet) or being a cloud.

[0029] It should be noted that the features of the method described in the context can also be features of the computer program and / or the computer-readable medium (and vice versa).

[0030] Embodiments of the invention can be considered to be based on the following concepts and cognitions. These embodiments are not intended to limit the scope of the invention.

[0031] According to one embodiment, the test threshold can be less than the operating threshold. This is particularly useful when the operating parameter is the traveling speed or acceleration of the car, especially the deceleration. However, in certain cases, it can also be useful if the test threshold is higher than the operating threshold. The test threshold can differ from the operating threshold by for example at least 2%, at least 5%, at least 10% or at least 20%.

[0032] According to one embodiment, the trigger threshold can be defined according to the permitted maximum value of a safety-critical operating parameter. The permitted maximum value may lie between the operating threshold and the test threshold. The permitted maximum value can deviate from the operating threshold and the test threshold by for example at least 2%, at least 5%, at least 10% or at least 20%. Preferably, the operating threshold is greater than the permitted maximum value and the test threshold is less than the permitted maximum value.

[0033] The operating threshold can exceed the allowed maximum value by a certain amount, which in some cases can be specified by a standard. For example, the operating threshold for the car running speed can be equal to 115% of the maximum allowed running speed, and the operating threshold for the deceleration during the braking process when the car stops at the end of the shaft can be equal to 110% of the maximum allowed deceleration.

[0034] According to one embodiment, the test threshold can be determined by multiplying the allowed maximum value by a predefined coefficient. The predefined coefficient can be positive or negative.

[0035] According to one embodiment, the predefined coefficient can be read from a write-protected memory (such as the write-protected memory of a safety device or an elevator controller at a higher level). For example, the test threshold may be programmed into the memory during the manufacturing process. This prevents or makes it difficult to overwrite the predefined coefficient with other values, thus preventing unauthorized operations on the predefined coefficient. The memory can be, for example, ROM, PROM, EPROM, EEPROM, flash memory, or a combination of at least two of these examples.

[0036] Furthermore, for the same reason, the allowed maximum value or the operating threshold can be stored in the write-protected memory, or both the allowed maximum value and the operating threshold can be stored in the write-protected memory.

[0037] According to one embodiment, the predefined coefficient can be between 0.90 and 0.99, especially between 0.96 and 0.98. Such values have proven to be particularly suitable for practical use in tests.

[0038] According to one embodiment, the safety device can be configured to determine the trigger threshold in the case of using the vertical position of the car and an assignment rule that assigns different trigger thresholds to different vertical positions of the car. In this case, the safety device can be configured by switching to the test mode to determine the trigger threshold using a second assignment rule different from the first assignment rule, instead of using the first assignment rule to assign different operating thresholds to different vertical positions of the car as different trigger thresholds, and the second assignment rule assigns different test thresholds to different vertical positions of the car as different trigger thresholds.

[0039] The safety device configured in the following way can monitor the deceleration of the car by means of the running speed and the vertical position of the car, that is, without directly measuring the deceleration. This monitoring is usually required during the braking process, in which the car stops at the end of the shaft (i.e., the top floor or the bottom floor) to prevent the car from traveling too far. By switching the safety device to the test mode, the relevant trigger thresholds can be easily and safely adapted.

[0040] According to one embodiment, the method may further include: controlling a drive device for driving the car to perform a test run for testing the configuration of a safety device, wherein during the test run, the safety device operates in a test mode. During the test run, the car may move vertically in the shaft. The test run may be performed in response to receiving another command, for example, in response to another input from a user. The test run may be automatically carried out in accordance with a defined flow. For example, when performing the test run, a test result may be generated, and the test result indicates whether the test of the configuration of the safety device is successful. Then, the test result may be stored in a memory and / or provided to the user via a user interface for evaluation, for example.

[0041] According to one embodiment, during the test run, the drive device may be controlled in such a way that the actual value approaches the permitted maximum value.

[0042] If the test threshold is lower than the permitted maximum value (as described above), and during the operation of the elevator equipment the actual value increases above the test threshold, this will cause the safety function to be triggered before the actual value reaches or exceeds the permitted maximum value. This can avoid overloading the elevator equipment during the test run.

[0043] According to one embodiment, the same permitted maximum value as for a normal run may be used for the test run. In other words, the test run may be carried out under the same operating conditions as the normal run. The term "normal run" may be understood, for example, as a run of the elevator equipment (successfully or certified) with passengers and / or goods on board after commissioning.

[0044] According to one embodiment, a safety-critical operating parameter may be one of the following parameters: the traveling speed of the car; the acceleration of the car, especially the deceleration of the car during the braking process, wherein the car stops at one end of the shaft; the vertical position of the car; the distance traveled by the car.

[0045] Here, it should be noted that: the operating parameter may be defined, determined directly with respect to the car, for example, or measured by means of sensors. The operating parameter may also be determined indirectly, for example, derived with respect to other elevator components. For example, a counterweight may be connected to the car by means of a suspension, such that the traveling speed, acceleration, position, or distance of the counterweight is clearly correlated with the corresponding characteristics of the car.

[0046] According to one embodiment, different test modes for different configurations of the elevator equipment may be stored in the safety device. The test thresholds of the different test modes may be different from each other. Here, the method may further include: selecting, according to the current configuration of the elevator equipment, the test mode to which the safety device is to be switched from the different test modes.

[0047] In other words, in order to test different configurations of the elevator equipment, different pre-configured trigger thresholds can be set by selecting appropriate test modes. Thus, the same safety device can be used for each elevator configuration. In other words, this method can be implemented using different elevator equipment without complex changes to the hardware configuration and / or software configuration of the safety device.

[0048] The test mode can be selected automatically and / or manually.

[0049] For example, the method may further include receiving configuration data that defines the current configuration of the elevator equipment. In this case, the test mode can be (automatically) selected from different test modes using the configuration data, for example, using a lookup table. Thereby, incorrect (manual) assignments can be avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Embodiments of the present invention will be described below with reference to the accompanying drawings. Neither the description nor the drawings should be construed as limiting the scope of the present invention.

[0051] Figure 1 An elevator equipment according to an embodiment of the present invention is shown.

[0052] Figure 2 Possible values of the trigger threshold of the safety device according to an embodiment of the present invention are shown.

[0053] The drawings are purely schematic and not drawn to scale. If the same reference numerals are used in different drawings, these reference numerals denote the same or equivalent features. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0054] Figure 1 An elevator equipment 1 for transporting people and / or goods between floors 2 of a building 3 is shown. The elevator equipment 1 includes: a shaft 4 that interconnects the floors 2; a car 5 that is movably arranged in the shaft 4 between the floors 2; a drive device 6 for lifting and lowering the car 5, such as an electric drive or a hydraulic drive; and a controller 7 (hereinafter referred to as the elevator controller 7) for controlling the components of the elevator equipment 1, in particular the drive device 6. The drive device 6 may additionally include a braking device for braking the car 5 and / or for stopping the car 5.

[0055] In addition, the elevator equipment 1 includes a safety device 8 for triggering a safety function that places the elevator equipment 1 in a safe state under certain operating conditions, for example, by disconnecting the safety circuit of the elevator equipment 1 and / or activating the braking device.

[0056] In this example, the elevator controller 7 and the safety device 8 each include a data processing device 9 having a processor 10 and a memory 11.

[0057] A computer program can be stored in the memory 11 of the safety device 8, wherein the processor 10 of the safety device 8 can be configured to receive actual values of one or more operating parameters of the elevator device 1 (such as the position or travel speed of the car 5) by executing the computer program during the operation of the elevator device 1, compare these actual values with corresponding trigger thresholds A (see Figure 2 ), and trigger a safety function if one of the actual values exceeds the trigger threshold A.

[0058] The actual values can be determined by means of one or more sensors of the elevator device 1, for example by means of a position sensor, a displacement sensor, a speed sensor, an acceleration sensor, an incremental detector, an absolute value detector or a combination of at least two of these examples. Such a sensor or such a combination of sensors can also be part of the safety device 8.

[0059] Similarly, the computer program can be stored in the memory 11 of the elevator controller 7, wherein the processor 10 of the elevator controller 7 can be configured to receive the above-mentioned actual values by executing the computer program and control the elevator device 1, in particular the drive device 6, in such a way that the corresponding operating parameters approach the permitted maximum value S in terms of their actual values (see Figure 2 ).

[0060] For example, if the operating parameter is the travel speed of the car 5, the permitted maximum value S corresponds to the maximum permitted travel speed of the car 5. The maximum permitted travel speed can have a curve related to the vertical distance of the car 5 to the top and / or bottom of the floor 2. This curve can be stored in the memory 11 of the elevator controller 7 in the form of a look-up table and / or a mathematical function, for example.

[0061] In addition, the processor 10 of the elevator controller 7 can be configured to switch the safety device 8 to a special test mode by executing the computer program to test the configuration of the safety device, provided that the processor 10 receives a corresponding command, such as based on an input from a user. For this purpose, the elevator controller 7 and the safety device 8 can be interconnected by wired and / or wireless means for data communication.

[0062] By switching the safety device 8 to the test mode, the operating threshold 12 used by the safety device 8 as the trigger threshold A during the normal operation of the elevator device 1 is replaced by a predefined test threshold 13 (see Figure 2 ). Then, the safety device 8 uses the test threshold 13 as the trigger threshold A.

[0063] As Figure 2As shown, the allowed maximum value S can be between the test threshold 13 and the operating threshold 12, where the test threshold 13 can be less than the allowed maximum value S, and the operating threshold 12 can be greater than the allowed maximum value S.

[0064] The operating threshold 12 or the test threshold 13 or both the operating threshold 12 and the test threshold 13 can be related to the allowed maximum value S. For example, the test threshold 13 for each operating parameter to be monitored can be determined by multiplying the corresponding allowed maximum value S (set as 1.00 here by way of example) by a predefined first coefficient. In addition, the operating threshold 12 for each operating parameter to be monitored can be determined by multiplying the corresponding allowed maximum value S by a predefined second coefficient different from the first coefficient.

[0065] In Figure 2 the example shown, for the travel speed and the deceleration at the end of the shaft, the first coefficient is equal to 0.98 in both cases. In contrast, the second coefficient is 1.15 for the travel speed and 1.10 for the deceleration at the end of the shaft. Depending on the configuration of the elevator installation 1, other coefficients are also possible.

[0066] The coefficients for different operating parameters can (but do not have to) differ in their magnitude and / or sign.

[0067] The operating threshold 12, the test threshold 13, the allowed maximum value S, the first coefficient or the second coefficient or a combination of at least two of these values can be read from a write-protected memory segment of the memory 11 of the safety device 8 and / or the elevator controller 7 (for example from ROM, PROM, EPROM, EEPROM, flash memory or a combination of at least two of these examples). The memory segment can additionally or alternatively be protected against changes by encryption, for example by using an encryption key pair consisting of a private key and a public key. A method known as secure boot is also possible.

[0068] The safety device 8 can be configured to determine the triggering threshold A when using the vertical position of the car 5 and an assignment rule that assigns different triggering thresholds A to different vertical positions of the car 5. In this case, the safety device 8 is configured, by switching to a test mode, to determine the triggering threshold A using a second assignment rule different from the first assignment rule, rather than using the first assignment rule which assigns different operating thresholds 12 as different triggering thresholds A to different vertical positions of the car 5, and the second assignment rule assigns different test thresholds 13 as different triggering thresholds A to different vertical positions of the car 5. For example, the operating threshold 12 and the test threshold 13 can be driving speed values. This enables monitoring of the deceleration of the car 5 based on the driving speed and vertical position of the car 5 during the braking process when the car 5 stops at the end of the shaft (i.e., the top or bottom of floor 2), without directly measuring the deceleration. By switching the safety device 8 to the test mode, the relevant triggering threshold A can be easily and safely adapted.

[0069] The processor 10 of the elevator controller 7 can also be configured to execute a test method by executing a computer program after the safety device 8 switches to the test mode, in which mode the car 5 performs one (or more) test runs by correspondingly controlling the drive device 6. During the test run, the safety device 8 is in the test mode, i.e., the triggering threshold A is set to the test threshold 13, and the drive device 6 is controlled in such a way that at least one operating parameter approaches the permitted maximum value S in terms of its actual value. Here, the triggering threshold A is exceeded, which enables checking the configuration of the safety device without increasing the actual value to be greater than the permitted maximum value S or the operating threshold 12. This avoids overloading the elevator installation 1 during the test run due to excessive driving speed and / or excessive deceleration.

[0070] Optionally, the safety device 8 can be switched to different test modes with different test thresholds. Depending on the configuration of the elevator installation 1 to be tested, a suitable test mode can be selected automatically and / or manually.

[0071] For this purpose, for example, configuration data defining the current configuration of the elevator installation 1 can be received in the elevator controller 7. Then, the elevator controller 7 can determine a suitable test mode and switch the safety device 8 to the suitable test mode using the configuration data and a list stored in the memory 11, which assigns a feasible test mode to each feasible configuration.

[0072] In the electronic safety device 8, the monitoring limit values of the electronic safety device can be parameterized, and this test mode, which can be activated (and deactivated) by the elevator controller 7, can easily check the configuration of the safety device 8 without deviating the elevator installation 1 from the operating conditions set for it.

[0073] The test mode can be activated (and deactivated) for example via the serial interface of the elevator controller.

[0074] For this purpose, the test mode is first activated and then a normal journey is started. If a safety function is triggered hereby, this is confirmed as: the permitted maximum value S specified for the respective operating parameters (such as the travel speed) is correct, i.e., neither too high (because the safety device 8 will not trigger the safety function) nor too low, because the travel may not be possible at all (i.e., even at a very low travel speed, the safety device 8 will trigger the safety function).

[0075] If the test mode is accidentally activated or accidentally not deactivated, this does not limit the safety during the normal operation of the elevator installation 1, but at most the reliability. On the contrary, the above coefficients (and the corresponding permitted maximum value S) are particularly important for safety and should therefore be stored in a manipulation-proof manner in the safety device 8 and / or the elevator control system 7.

[0076] In short, the above procedure has the following advantages:

[0077] The configuration of the safety device 8 can be verified by means of the normal operating parameters of the elevator installation, such that the same method can be used for each elevator installation and tested within the safety limits.

[0078] By integrating the activation and / or deactivation of the test mode into the acceptance test, automation of the acceptance test can be achieved.

[0079] The check of the configuration of the safety device 8 is unambiguous (whether the safety function is triggered) and is therefore safe.

[0080] By means of a simpler and safer acceptance test, the overall commissioning time required for the elevator installation is shorter.

[0081] The elevator installation does not need to be subjected to an excessive load to test the configuration of the safety device 8.

[0082] Finally, it should be noted that: terms such as "comprising", "including", "containing" etc. do not exclude other elements or steps, and indefinite articles such as "a" or "an" do not exclude a plurality. It should also be noted that: features or steps introduced with reference to one of the above embodiments can also be used in combination with features or steps introduced with reference to other of the above embodiments. The reference signs in the claims should not be construed as limiting the scope of the subject matter defined by the claims.

[0083] List of reference signs

[0084] 1 Elevator installation

[0085] 2 Floor

[0086] 3 Building

[0087] 4 vertical shaft

[0088] 5 car

[0089] 6 drive device

[0090] 7 control device / elevator controller

[0091] 8 safety device

[0092] 9 data processing device

[0093] 10 processor

[0094] 11 memory

[0095] 12 operating threshold

[0096] 13 test threshold

[0097] A trigger threshold

[0098] S maximum allowable value

Claims

1. A method for configuring a safety device (8) of an elevator installation (1), wherein, The elevator installation (1) includes a car (5) that can travel between multiple floors (2) of a building (3), wherein a safety device (8) is configured to trigger a safety function when an actual value of a safety-critical operating parameter of the elevator installation (1) exceeds a trigger threshold (A), and the method includes: Switching the safety device (8) to a test mode to test the configuration of the safety device, wherein by switching to the test mode, the safety device (8) is configured to: use a test threshold (13) different from the operating threshold (12) as the trigger threshold (A) instead of the operating threshold (12) used as the trigger threshold (A) by the safety device (8) during normal operation of the elevator installation (1).

2. The method according to claim 1, Among them, The test threshold (13) is less than the operating threshold (12).

3. The method according to any one of the preceding claims, Among them, Defining the trigger threshold (A) according to an allowed maximum value (S) of a safety-critical operating parameter; wherein the allowed maximum value (S) is between the operating threshold (12) and the test threshold (13).

4. The method according to claim 3, Among them, The test threshold (13) is determined by multiplying the allowed maximum value (S) by a predefined coefficient.

5. The method according to claim 4, Among them, The predefined coefficient is read from a write-protected memory (11); and / or wherein the predefined coefficient is between 0.90 and 0.99, in particular between 0.96 and 0.

98.

6. The method according to any one of the preceding claims, Among them, The safety device (8) is configured to: determine the trigger threshold (A) in the case of using the vertical position of the car (5) and an assignment rule that assigns different trigger thresholds (A) to different vertical positions of the car (5), wherein by switching to the test mode, the safety device (8) is configured to: use a second assignment rule different from the first assignment rule to determine the trigger threshold (A) instead of the first assignment rule, wherein the first assignment rule assigns different operating thresholds (12) to different vertical positions of the car (5) as different trigger thresholds (A), and the second assignment rule assigns different test thresholds (13) to different vertical positions of the car (5) as different trigger thresholds (A).

7. The method according to any one of the preceding claims, the method further includes: Controlling a drive device (6) to drive the car (5) in order to perform a test run for testing the configuration of the safety device, wherein the safety device (8) operates in the test mode during the test run.

8. The method according to claim 7 that refers to claim 3, Among them, During the test run, the drive device (6) is controlled in such a way that the actual value approaches the allowed maximum value (S); and / or Using the same allowed maximum value (S) for the test run as for the normal run.

9. The method according to any one of the preceding claims, Among them, The safety-critical operating parameter is one of the following parameters: the traveling speed of the car (5); the acceleration of the car (5), in particular the deceleration of the car (5) during the braking process when the car (5) stops at the end of the shaft; the vertical position of the car (5); the distance traveled by the car (5).

10. The method according to any one of the preceding claims, Among them, different test modes corresponding to different configurations of the elevator installation (1) are stored in the safety device (8), and the different test modes differ from one another with respect to their test thresholds (13), the method further comprising: selecting, according to the current configuration of the elevator installation (1), the test mode to which the safety device (8) is to be switched from the different test modes.

11. A data processing device (9) comprising a processor (10) configured to carry out the method according to any one of the preceding claims.

12. A safety device (8) for use in the method according to any one of claims 1 to 10, Among them, the safety device (8) being configured to: trigger a safety function of the elevator installation (1) when an actual value of a safety-critical operating parameter of the elevator installation (1) exceeds a trigger threshold (A), and being able to switch to a test mode for testing the configuration of the safety device, wherein the safety device (8) is configured, in the test mode, to use a test threshold (13) different from the operating threshold (12) as the trigger threshold (A) instead of the operating threshold (12) used as the trigger threshold (A) by the safety device (8) during normal operation of the elevator installation (1).

13. An elevator installation (1) comprising: a shaft (4) interconnecting a plurality of floors (2) of a building (3); a car (5) which is able to travel in the shaft (4) between the plurality of floors (2); a drive device (6) for driving the car (5); the data processing device (9) according to claim 11; the safety device (8) according to claim 12.

14. A computer program comprising instructions which, when executed by a processor (10), cause the processor (10) to carry out the method according to any one of claims 1 to 10.

15. A computer-readable medium having stored thereon the computer program according to claim 14.

Images