Method for testing a configuration of a safety device of an elevator system

Abstract

The invention relates to a method for testing a configuration of a safety device (8) of an elevator system (1), comprising: switching the safety device (8), which is configured to trigger a safety function when an actual value of a safety-relevant operating parameter of the elevator system (1) exceeds a trigger threshold (A), to a test mode to test the configuration of the safety device, wherein the safety device (8) is configured, by switching to the test mode, to use, instead of an operating threshold value (12) which the safety device (8) uses as the trigger threshold (A) in normal operation of the elevator system (1), a test threshold value (13), which differs from the operating threshold value (12), as the trigger threshold (A).

Description

[0001] Method for testing a configuration of a safety device of an elevator installation

[0002] The present invention relates to a method for testing a configuration of a safety device of an elevator installation. Furthermore, the invention relates to a data processing device, a computer program and a computer-readable medium for executing the method, a safety device suitable for use in the method, and an elevator installation.

[0003] An elevator system, such as one used to transport people and / or goods in buildings, is typically equipped with a safety device that monitors one or more operating parameters, such as travel speed or car deceleration at the end of the shaft, and automatically triggers one or more safety functions if an actual value of the respective operating parameter exceeds a certain trigger threshold. The elevator system is then usually transferred to a safe state by interrupting the safety circuit. The trigger threshold is usually above a permissible maximum value for the respective operating parameter. For example, the trigger threshold can be 110% of the permissible maximum value.

[0004] It may be necessary to adjust certain settings relating to such a safety function on-site, for example during commissioning. To do so, a technician can take certain permissible maximum values ​​for safety-relevant operating parameters from the elevator control system and use them to determine trigger thresholds tailored to the specific elevator system by adding a certain margin to each of these maximum values. Errors can easily occur in this process. The safety device adapted in this way can then be tested by conducting a test run in which the elevator system is operated differently than in normal operation, for example, at an increased travel speed, in order to specifically trigger the safety function and thus verify that the settings have been adjusted correctly. However, this can place a significant strain on the elevator system.

[0005] EP 1 510 492 A1 describes an example of a method for testing an elevator system. Therefore, there may be a need for a method that makes it possible to avoid excessive loads on an elevator system when testing safety functions during a test run.

[0006] Furthermore, there may be a need for a corresponding data processing device, a corresponding safety device, a corresponding elevator system, a corresponding computer program and a corresponding computer-readable medium.

[0007] These needs can be met by the subject matter of the independent claims. Advantageous embodiments are set forth in the dependent claims, the following description, and the accompanying figures.

[0008] A first aspect of the invention relates to a method for testing a configuration of a safety device of an elevator system comprising a car movable between multiple floors of a building. The safety device is configured to trigger a safety function when an actual value of a safety-relevant operating parameter of the elevator system exceeds a trigger threshold. The method comprises switching the safety device to a test mode for testing the configuration of the safety device. By switching the safety device to test mode, the safety device is configured to use a test threshold that differs from the operating threshold as the trigger threshold, instead of an operating threshold that the safety device uses as the trigger threshold during normal operation of the elevator system.

[0009] The method can be computer-implemented and executed automatically by a processor, for example of the safety device or a (higher-level) elevator control.

[0010] The term "exceeding" can also mean "falling below." In other words, the trigger threshold can be exceeded in different directions.

[0011] Preferably, the trigger threshold is lowered to the test threshold by activating the test mode, so that the safety function is already triggered (e.g., by opening a switch in the safety circuit) when the elevator system is operating under normal operating conditions, such as normal travel speed and / or normal deceleration. This avoids excessive loads on the elevator system when testing the safety device configuration during a test run.

[0012] When driving with the test mode deactivated, the safety function should only be triggered if the operating conditions are not normal for any reason, for example if the driving speed is significantly higher than under normal operating conditions, i.e. significantly above a permissible maximum driving speed.

[0013] The test threshold can be fixed. For example, the test threshold can be read from a read-only memory (see below). This has the effect that a user cannot change the test threshold, or can only do so with considerable effort and / or after providing proof of authorization. Furthermore, this eliminates the need for manual adjustment of the trigger threshold on-site, which is usually significantly more complex than simply switching the security device to a test mode with a preconfigured trigger threshold(s).

[0014] The test threshold may, for example, be an empirical value, determined in experiments, calculated from known parameters or determined by computer simulations or computer modelling.

[0015] Switching to test mode preferably occurs in response to the receipt of a corresponding command. The command can be a user input. In other words, test mode can be activated manually. However, automatic generation of the command (and thus automatic activation of test mode) is also conceivable, for example, as part of a computer-executed test program for testing the elevator system.

[0016] A second aspect of the invention relates to a data processing device comprising a processor configured to execute the method described above and below. The data processing device may comprise hardware and / or software modules. In addition to the processor, the data processing device may comprise a memory and a data communication interface for wireless and / or wired data communication with peripheral devices.

[0017] The data processing device can, for example, be a component of the safety device described above and below. However, the data processing device can also be a component of a control device (also called an elevator controller) for controlling the elevator system.

[0018] It should be noted that features of the method as described above and below may also be features of the data processing device (and vice versa).

[0019] A third aspect of the invention relates to a safety device for use in the method described above and below. The safety device is configured to trigger a safety function of an elevator system when an actual value of a safety-relevant operating parameter of the elevator system exceeds a trigger threshold. Furthermore, the safety device can be switched to a test mode for testing the configuration of the safety device. In test mode, the safety device is configured to use a test threshold that differs from the operating threshold as the trigger threshold, instead of an operating threshold that the safety device uses as the trigger threshold during normal operation of the elevator system.

[0020] The safety device may additionally include one or more sensors for detecting the actual value. Such a sensor may be, for example, a position sensor, a displacement sensor, a speed sensor, an acceleration sensor, an incremental encoder, an absolute encoder, or a combination of at least two of these examples.

[0021] The safety device can be configured to open one or more switches of a safety circuit of the elevator system when the safety function is triggered, thereby interrupting the power supply to a drive device of the elevator system. In this case, a braking device of the elevator system can be (automatically) activated, bringing the elevator car(s) to a standstill and / or holding them at a standstill.

[0022] The safety device can, for example, be designed as an (electronic) speed limiter.

[0023] It should be noted that features of the method as described above and below may also be features of the security device (and vice versa).

[0024] A fourth aspect of the invention relates to an elevator system. The elevator system comprises a shaft connecting several floors of a building, a car that can be moved in the shaft between the floors, a drive device for driving the car, the data processing device described above and below, and the safety device described above and below.

[0025] The drive device may, for example, comprise an electric and / or hydraulic drive. The drive device may also comprise a braking device for decelerating the cabin and / or holding the cabin stationary.

[0026] Further aspects of the invention relate to a computer program and a computer-readable medium on which the computer program is stored.

[0027] The computer program comprises instructions which, when the computer program is executed by the processor, cause the processor to carry out the method described above and below.

[0028] The computer-readable medium may be a volatile or non-volatile data storage device. For example, the computer-readable medium may be a hard disk, a universal serial bus (USB) storage device, a random-access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, or a combination of two or more of these examples. The computer-readable medium may also be a data communications network that enables downloading of program code (e.g., over the Internet), or a cloud.

[0029] It should be noted that features of the method as described above and below may also be features of the computer program and / or the computer-readable medium (and vice versa).

[0030] Embodiments of the invention may be considered based on the ideas and findings described below. These embodiments are not to be construed as limiting the scope of the invention.

[0031] According to one embodiment, the test threshold can be lower than the operating threshold. This is particularly useful when the operating parameter is a driving speed or acceleration, especially deceleration, of the car. In certain cases, however, it may also be useful for the test threshold to be higher than the operating threshold. The test threshold can deviate from the operating threshold by, for example, at least 2%, at least 5%, at least 10%, or at least 20%.

[0032] According to one embodiment, the trigger threshold can be defined depending on a permissible maximum value of the safety-relevant operating parameter. The permissible maximum value can be between the operating threshold and the test threshold. The permissible maximum value can deviate from the operating threshold and the test threshold, for example, by at least 2%, at least 5%, at least 10%, or at least 20%. Preferably, the operating threshold is higher and the test threshold is lower than the permissible maximum value.

[0033] The operating threshold may exceed the maximum permissible value by a certain amount, which in some cases may be specified by a standard. For example, the operating threshold for the car's travel speed may be equal to 115% of the maximum permissible travel speed, and the operating threshold for the car's deceleration during a braking maneuver, in which the car is brought to a stop at a shaft end, may be equal to 110% of the maximum permissible deceleration.

[0034] According to one embodiment, the test threshold can be determined by multiplying the permissible maximum value by a predefined factor. The predefined factor can be positive or negative.

[0035] According to one embodiment, the predefined factor can be read from a read-only memory, for example, of the safety device or a (higher-level) elevator controller. For example, the test threshold value can be programmed into the memory during manufacture. This prevents or complicates overwriting the predefined factor with other values ​​and thus unauthorized manipulation of the predefined factor. The memory can be, for example, a ROM, a PROM, an EPROM, an EEPROM, a flash memory, or a combination of at least two of these examples.

[0036] Additionally, and for the same reason, the permissible maximum value or the operating threshold, or both the permissible maximum value and the operating threshold, may be stored in read-only memory. According to one embodiment, the predefined factor may be between 0.90 and 0.99, in particular between 0.96 and 0.98. Such values ​​have proven particularly suitable for practical use in tests.

[0037] According to one embodiment, the safety device can be configured to determine the trigger threshold using a vertical position of the car and an assignment rule that assigns different trigger thresholds to different vertical positions of the car. In this case, the safety device can be configured, by switching to test mode, to use a second assignment rule that differs from the first assignment rule and assigns different test thresholds to the different vertical positions of the car as the different trigger thresholds to determine the trigger threshold, instead of a first assignment rule that assigns different operating thresholds to the different vertical positions of the car as the different trigger thresholds.

[0038] The safety device configured in this way enables monitoring of the car's deceleration based on the travel speed and vertical position of the car, i.e., without the need to directly measure the deceleration. Such monitoring is typically required during a braking operation, in which the car is brought to a stop at a shaft end (i.e., at a top or bottom floor), to prevent the car from overtraveling. By switching the safety device to test mode, the related trigger thresholds can be easily and safely adjusted.

[0039] According to one embodiment, the method may further comprise: controlling a drive device for driving the car to perform a test run to test the configuration of the safety device, wherein the safety device is operated in test mode during the test run. During the test run, the car can be moved vertically in a shaft. It is possible for the test run to be performed in response to the receipt of a further command, for example in response to a further input from a user. The test run can be performed automatically according to a defined sequence. When performing the test run, for example, a test result can be generated that indicates whether the test of the configuration of the safety device was successful or not. The test result can then, for example, be stored in a memory and / or provided to a user for evaluation via a user interface.According to one embodiment, the drive device can be controlled during the test run in such a way that the actual value approaches the permissible maximum value.

[0040] If the test threshold is below the permissible maximum value (as mentioned above) and the actual value is increased above the test threshold during elevator operation, the safety function is triggered before the actual value reaches or exceeds the permissible maximum value. This prevents excessive loads on the elevator system during the test run.

[0041] According to one embodiment, the same permissible maximum value can be used for the test run as for a normal run. In other words, the test run can be conducted under the same operating conditions as for a normal run. The term "normal run" can, for example, be understood as a run with passengers and / or goods after the (successful or certified) commissioning of the elevator system.

[0042] According to one embodiment, the safety-relevant operating parameter can be one of the following parameters: a travel speed of the car; an acceleration of the car, in particular a deceleration of the car during a braking process in which the car is brought to a stop at a shaft end; a vertical position of the car; a distance traveled by the car.

[0043] It should be noted that the operating parameter can be defined, determined, or measured directly with reference to the car, for example, using sensors. However, the operating parameter can also be derived indirectly, e.g., with reference to other elevator components. For example, a counterweight can be connected to the car via suspension elements, so that the travel speed, acceleration, position, or travel of the counterweight clearly correlate with the corresponding properties of the car.

[0044] According to one embodiment, different test modes for different configurations of the elevator system can be stored in the safety device. The different test modes can differ from one another in their test threshold values. In this case, the method can further comprise: selecting the test mode to which the safety device is to be switched from the different test modes depending on a current configuration of the elevator system. In other words, different preconfigured trigger thresholds can be set for testing different configurations of the elevator system by selecting a suitable test mode. Thus, the same safety device can be used for each elevator configuration. In other words, the method can be carried out with different elevator systems without requiring complex changes to the hardware and / or software configuration of the safety device.

[0045] The test mode can be selected automatically and / or manually.

[0046] For example, the method may further comprise receiving configuration data that defines the current configuration of the elevator system. In this case, the test mode can be (automatically) selected from the different test modes using the configuration data, for example, using a lookup table. This avoids incorrect (manual) assignments.

[0047] Embodiments of the invention are described below with reference to the accompanying drawings. Neither the description nor the drawings are to be construed as limiting the scope of the invention.

[0048] Fig. 1 shows an elevator system according to an embodiment of the invention.

[0049] Fig. 2 illustrates possible values ​​of a trigger threshold of a safety device according to an embodiment of the invention.

[0050] The drawings are purely schematic and not to scale. Where identical reference symbols are used in different drawings, these reference symbols indicate identical or equivalent features.

[0051] Fig. 1 shows an elevator system 1 for transporting people and / or goods between floors 2 of a building 3. The elevator system 1 comprises a shaft 4 which connects the floors 2 to one another, a car 5 which is arranged such that it can move in the shaft 4 between the floors 2, a drive device 6 for raising and lowering the car 5, for example an electric or hydraulic drive, and a control device 7 (hereinafter referred to as elevator control 7) for controlling components of the elevator system 1, in particular the drive device 6. The drive device 6 can additionally comprise a braking device for braking the car 5 and / or for holding the car 5 at a standstill.In addition, the elevator system 1 comprises a safety device 8 for triggering a safety function which transfers the elevator system 1 into a safe state under certain operating conditions, for example by opening a safety circuit of the elevator system 1 and / or activating the braking device.

[0052] In this example, the elevator control 7 and the safety device 8 each comprise a data processing device 9 with a processor 10 and a memory 11.

[0053] A computer program can be stored in the memory 11 of the safety device 8, wherein the processor 10 of the safety device 8 can be configured to receive actual values ​​of one or more operating parameters of the elevator installation 1 (for example a position or travel speed of the car 5) by executing the computer program during operation of the elevator installation 1, to compare them with a corresponding trigger threshold A (see Fig. 2) and to trigger the safety function if one of the actual values ​​exceeds the trigger threshold A.

[0054] The actual values ​​can be determined using one or more sensors of the elevator system 1, for example, using a position sensor, a displacement sensor, a speed sensor, an acceleration sensor, an incremental encoder, an absolute encoder, or a combination of at least two of these. Such a sensor or such a sensor combination can also be part of the safety device 8.

[0055] Likewise, a computer program can be stored in the memory 11 of the elevator control 7, wherein the processor 10 of the elevator control 7 can be configured to receive the aforementioned actual values ​​by executing the computer program and to control the elevator installation 1, in particular the drive device 6, such that the respective operating parameter in its actual value approaches a permissible maximum value S (see Fig. 2).

[0056] If, for example, the operating parameter is the travel speed of the car 5, the permissible maximum value S corresponds to a maximum permissible travel speed of the car 5. This can have a curve that depends on a vertical distance of the car 5 to the top and / or bottom of the floors 2. The curve can be stored, for example, in the form of a lookup table and / or a mathematical function in the memory 11 of the elevator control 7. Furthermore, the processor 10 of the elevator control 7 can be configured to switch the safety device 8 to a special test mode for testing the configuration of the safety device by executing the computer program, provided the processor 10 receives a corresponding command, for example as a result of an input from a user. For this purpose, the elevator control 7 and the safety device 8 can be connected to each other wired and / or wirelessly for data communication.

[0057] By switching the safety device 8 to test mode, an operating threshold 12, which the safety device 8 uses as the trigger threshold A during normal operation of the elevator system 1, is replaced by a predefined test threshold 13 (see Fig. 2). The safety device 8 then uses the test threshold 13 as the trigger threshold A.

[0058] As shown in Fig. 2, the permissible maximum value S can be between the test threshold 13 and the operating threshold 12, where the test threshold 13 can be smaller and the operating threshold 12 can be larger than the permissible maximum value S.

[0059] The operating threshold 12 or the test threshold 13, or the operating threshold 12 and the test threshold 13, may depend on the permissible maximum value S. For example, the test threshold 13 for each operating parameter to be monitored can be determined by multiplying the respective permissible maximum value S (which is set to 1.00 here, for example) by a predefined first factor. Additionally, the operating threshold 12 for each operating parameter to be monitored can be determined by multiplying the respective permissible maximum value S by a predefined second factor that differs from the first factor.

[0060] In the example shown in Fig. 2, the first factor is 0.98 for both the travel speed and the deceleration at the shaft end. The second factor, however, is 1.15 for the travel speed and 1.10 for the deceleration at the shaft end. Depending on the configuration of elevator system 1, other factors are also possible.

[0061] The factors for different operating parameters may (but do not have to) differ in their magnitude and / or sign.

[0062] The operating threshold 12, the test threshold 13, the permissible maximum value S, the first factor or the second factor, or a combination of at least two of these values ​​can be read from a read-only memory section of the memory 11 of the safety device 8 and / or the elevator controller 7 (e.g., from a ROM, PROM, EPROM, EEPROM, flash memory, or a combination of at least two of these examples). The memory section can additionally or alternatively be protected against changes by encryption, for example, using cryptographic key pairs consisting of a private key and a public key. Methods known as secure boot are also possible.

[0063] The safety device 8 can be configured to determine the trigger threshold A using a vertical position of the car 5 and an assignment rule that assigns different trigger thresholds A to different vertical positions of the car 5. In this case, the safety device 8 is configured by switching to test mode to use a second assignment rule that differs from the first assignment rule and assigns different test threshold values ​​13 to the different vertical positions of the car 5 as the different trigger thresholds A to determine the trigger threshold A, instead of a first assignment rule that assigns different operating threshold values ​​12 as the different trigger thresholds A to the different vertical positions of the car 5. The operating threshold values ​​12 and the test threshold values ​​13 can be, for example, driving speed values.This allows monitoring of the deceleration of car 5 during a braking operation in which car 5 is brought to a stop at a shaft end (i.e., at the top or bottom of floors 2) based on the travel speed and the vertical position of car 5, without the need to directly measure the deceleration. By switching safety device 8 to test mode, the corresponding trigger thresholds A can be easily and safely adjusted.

[0064] The processor 10 of the elevator control 7 can further be configured to execute a test procedure by executing the computer program after the safety device 8 has been switched to test mode, in which the car 5 performs one test run (or several test runs) by appropriately controlling the drive device 6. During the test run, the safety device 8 is operated in test mode, i.e., the trigger threshold A is set to the test threshold 13, and the drive device 6 is controlled such that the actual value of at least one operating parameter approaches the permissible maximum value S. In the process, the trigger threshold A is exceeded, which enables the configuration of the safety device to be checked without the actual value having to be increased beyond the permissible maximum value S or the operating threshold 12.This avoids excessive loading of the elevator system 1 during the test run, for example due to an excessively high travel speed and / or an excessively strong deceleration.

[0065] Optionally, the safety device 8 can be switched to different test modes that differ in their test threshold values. The selection of a suitable test mode can be automatic and / or manual depending on the configuration of the elevator system 1 to be tested.

[0066] For this purpose, for example, configuration data defining a current configuration of the elevator system 1 can be received in the elevator control system 7. The elevator control system 7 can then determine a suitable test mode using the configuration data and a list stored in the memory 11, which assigns one of the possible test modes to each possible configuration, and switch the safety device 8 to the appropriate test mode.

[0067] In the case of an electronic safety device 8 whose monitoring limits can be parameterized, such a test mode, which can be activated (and deactivated) by the elevator control 7, enables a simple check of the configuration of the safety device 8 without the elevator installation 1 having to be operated in a manner deviating from the operating conditions intended for it.

[0068] The test mode can be activated (and deactivated), for example, via a serial interface of the elevator control.

[0069] To do this, test mode is first activated, followed by a normal drive. If the safety function is triggered, this confirms that the permissible maximum value S specified for the respective operating parameter (e.g., the driving speed) is correct, i.e., it is neither too high, as safety device 8 would then not trigger the safety function, nor too low, as the drive might then not be able to be performed at all (i.e., safety device 8 would trigger the safety function even at a very low driving speed).

[0070] If the test mode is accidentally activated or accidentally left unactivated, this does not limit the safety during normal operation of the elevator system 1, but at most the reliability. However, the aforementioned factors (and the respective permissible maximum values ​​S) are particularly relevant to safety; they should therefore be stored in the safety device 8 and / or the elevator control system 7, protected from tampering. In summary, the method described above offers the following advantages:

[0071] - The configuration of the safety device 8 can be verified using the normal travel parameters of the elevator system, so that each elevator system can be tested using the same procedure and within the safety limits.

[0072] - Acceptance tests can be automated by integrating the activation and / or deactivation of test mode into the acceptance tests.

[0073] - The verification of the configuration of the safety device 8 is unambiguous (safety function is triggered or not triggered) and therefore safe.

[0074] - Thanks to the simpler and safer acceptance test, commissioning of the elevator system takes less time overall.

[0075] - The elevator system does not need to be subjected to excessive load to test the configuration of safety device 8.

[0076] Finally, it should be noted that terms such as "comprising," "including," "including," "having," etc., do not exclude other elements or steps, and indefinite articles such as "a" or "an" do not exclude a plurality. Furthermore, it should be noted that features or steps described with reference to one of the above embodiments may also be used in combination with features or steps described with reference to other of the above embodiments. Reference signs in the claims are not to be understood as limiting the scope of the subject matter defined by the claims.

[0077] List of reference symbols

[0078] 1 elevator system

[0079] 2 floors

[0080] 3 Building 4 Shaft

[0081] 5 cabins

[0082] 6 Drive device

[0083] 7 Control unit / elevator control

[0084] 8 Security device 9 Data processing device

[0085] 10 processor

[0086] 11 storage

[0087] 12 Operating threshold

[0088] 13 Test threshold A trigger threshold

[0089] S permissible maximum value

Claims

Claims 1. A method for testing a configuration of a safety device (8) of an elevator installation (1), wherein the elevator installation (1) comprises a car (5) movable between several floors (2) of a building (3), wherein the safety device (8) is configured to trigger a safety function if an actual value of a safety-relevant operating parameter of the elevator installation (1) exceeds a trigger threshold (A), the method comprising: Switching the safety device (8) into a test mode for testing the configuration of the safety device, wherein the safety device (8) is configured by switching into the test mode to use a test threshold value (13) that differs from the operating threshold value (12) as the trigger threshold (A) instead of an operating threshold value (12) that the safety device (8) uses as the trigger threshold (A) during normal operation of the elevator installation (1).

2. The method according to claim 1, wherein the test threshold (13) is smaller than the operating threshold (12).

3. Method according to one of the preceding claims, wherein the trigger threshold (A) is defined as a function of a permissible maximum value (S) of the safety-relevant operating parameter; wherein the permissible maximum value (S) lies between the operating threshold value (12) and the test threshold value (13).

4. The method according to claim 3, wherein the test threshold value (13) is determined by multiplying the permissible maximum value (S) by a predefined factor.

5. The method according to claim 4, wherein the predefined factor is read from a write-protected memory (11); and / or wherein the predefined factor is between 0.90 and 0.99, in particular between 0.96 and 0.

98. Method according to one of the preceding claims, wherein the safety device (8) is configured to determine the trigger threshold (A) using a vertical position of the car (5) and an assignment rule that assigns different trigger thresholds (A) to different vertical positions of the car (5); wherein the safety device (8) is configured, by switching to test mode, to use a second assignment rule that differs from the first assignment rule and assigns different test threshold values ​​(13) to the different vertical positions of the car (5) as the different trigger thresholds (A) to determine the trigger threshold (A), instead of a first assignment rule that assigns different operating threshold values ​​(12) to the different vertical positions of the car (5). Method according to one of the preceding claims, further comprising: Controlling a drive device (6) for driving the car (5) in order to carry out a test run to test the configuration of the safety device, wherein the safety device (8) is operated in test mode during the test run. Method according to claim 7, dependent on claim 3, wherein the drive device (6) is controlled during the test run such that the actual value approaches the permissible maximum value (S); and / or wherein the same permissible maximum value (S) is used for the test run as for a normal run. Method according to one of the preceding claims, wherein the safety-relevant operating parameter is one of the following parameters: a travel speed of the car (5); an acceleration of the car (5), in particular a deceleration of the car (5) during a braking process in which the car (5) is brought to a stop at a shaft end; a vertical position of the car (5); a distance traveled by the car (5).Method according to one of the preceding claims, wherein different test modes for different configurations of the elevator installation (1) are stored in the safety device (8) and the different test modes differ from one another in their test threshold values ​​(13), the method further comprising:. Selecting the test mode to which the safety device (8) is to be switched from the different test modes depending on the current configuration of the elevator system (1).

11. Data processing device (9) comprising a processor (10) configured to carry out the method according to one of the preceding claims.

12. Safety device (8) for use in the method according to one of claims 1 to 10, wherein the safety device (8) is configured to trigger a safety function of an elevator installation (1) when an actual value of a safety-relevant operating parameter of the elevator installation (1) exceeds a trigger threshold (A), and is switchable into a test mode for testing the configuration of the safety device, wherein the safety device (8) is configured in the test mode to use a test threshold value (13) deviating from the operating threshold value (12) as the trigger threshold (A) instead of an operating threshold value (12) which the safety device (8) uses as the trigger threshold (A) during normal operation of the elevator installation (1).

13. Elevator system (1), comprising: a shaft (4) connecting several floors (2) of a building (3); a car (5) movable in the shaft (4) between the floors (2); a drive device (6) for driving the car (5); the data processing device (9) according to claim 11; the safety device (8) according to claim 12.

14. A computer program comprising instructions which cause a processor (10) to carry out the method according to any one of claims 1 to 10 when the computer program is executed by the processor (10).

15. A computer-readable medium on which the computer program according to claim 14 is stored.

Images