EP3233697B1 - Method for operating an electronic security system with temporary participants - Google Patents

Description

The invention relates to a method for operating a safety system with temporary subscribers, as well as to a safety system which is intended to carry out this method and to an elevator installation with this.

Elevator systems are equipped with safety systems for safe operation. These security systems typically consist of serially connected security elements. For example, these security elements can monitor the condition of manhole or car doors. Electromechanical safety circuits or bus-based safety circuits are known. The safe operation of such bus-based safety circuits is regularly checked. Construction and test methods of such bus-based safety circuits are, for example EP 1159218 A1 . WO 2010/097404 A1 or WO 2013/020806 A1 known. From this prior art, however, it is not clear whether or to what extent the security when connecting or disconnecting temporary subscribers, such as a hand control device for controlling the elevator installation during maintenance or an input device in the configuration settings of the security system can be adjusted, is ensured.

It is therefore an object of the invention to provide a method or a security system and an elevator installation with such a security system, with which or which the secure establishment of a connection between temporary participants and the security system is ensured.

This object is achieved by a method, a safety system and an elevator installation with this safety system having the features of the independent patent claims.

The safety system of the elevator installation comprises a control unit, a bus, a plurality of bus nodes which are connected to the control unit via the bus and a Plurality of subscribers connected to the control unit via a bus node.

As a control unit is understood here a unit that has at least a microprocessor, a memory and a memory. Such a control unit is therefore designed to execute computer-aided programs. The control unit is configured here as a safety control unit which monitors safety-relevant states of the elevator installation and brings the elevator installation back into a safe state when an unsafe condition occurs. This includes, for example, the monitoring of the shaft door conditions, wherein the elevator system is shut down when a shaft door is open.

As participants, sensors, switch contacts, operating elements or actuators are understood here, which on the one hand monitor a state of the elevator installation and on the other hand can exert influence on the safe operation of the elevator installation. These include position, speed or acceleration sensors which monitor a state of motion of an elevator car as well as switch contacts which monitor a shaft or car door state or the passage of a predetermined end position through the elevator car. A security system may also include controls via which control commands for the control system of the security system or the elevator installation, the configuration of the security system or the selection of an operating mode can be entered, such as a switch button, an input screen or a manual control device. Actuators are understood to be all components that can be actuated by the control unit in order to restore an elevator installation to a safe state after the detection of an impermissible state, such as a drive motor, a holding brake or a safety brake. The listing of the aforementioned participants is only an example and not exhaustive.

The security system may have at least one participant who is designed as a temporary participant. A temporary subscriber is here understood to be a subscriber who is connected to the security system or the control unit only for a temporary time via a bus node. Such temporary participants can, for example, as controls, governor elements or Be bridged elements designed to be connected only in a certain operating mode, such as a normal operating mode, a maintenance mode or a configuration mode with the security system or should be connected.

Preferably, the temporary subscriber is registered in the security system by A) the temporary subscriber is connected to the security system at a bus node, B) the temporary subscriber is recognized by the control unit, C) the temporary subscriber is integrated into the security system by the control unit, and D) the temporary participant is actuated at least once.

Preferably, the security system is set by the control unit in a fault mode, if the temporary participant is not operated after the connection to the security system before the expiration of a predetermined time or if the temporary participant is disconnected after login without further manipulation of the security system from the security system. This ensures that the registration process of the temporary participant represents a deliberately performed action and that, for example, unintentional removal of the temporary participant can not lead to a dangerous condition of the elevator installation.

Under interference mode is understood here a mode in which the elevator system can not be operated or only limited. As a rule, the elevator system is shut down in the fault mode, so that a potentially dangerous situation can not even occur. At best, in the stolen mode, a last journey of the elevator car to a next floor could be permitted in order to avoid trapping of passengers in the elevator car. The lift system can then be put back into operation, if the action that led to the fault mode, was reversed. So if, for example, the unintentionally removed temporary participant is logged back into the security system.

Preferably, the temporary subscriber is logged in the security system by the temporary subscriber is announced before the connection by means of a manipulation of the security system at the control unit, the announcement by means of input of a control command at a designated entry point or can be done by pressing a switch. The entry point or the switch are each connected to the security system.

By means of the manipulation of the security system, an expectation is created in the control unit, which can be used for monitoring the registration process of a corresponding temporary subscriber.

Preferably, the security system is set by the control unit in a jamming mode, if the temporary subscriber is not connected to the security system before the expiration of a predetermined time after the manipulation of the security system or if the temporary subscriber is connected to the security system before manipulation of the security system.

Preferably, the recognition or integration of the temporary subscriber is confirmed by means of a display means. Here, a confirmation is issued to a maintenance technician in a simple manner that the security system is ready for a registration of the single operation of the temporary participant. The display means may be designed, for example, as an indicator light which is integrated in the corresponding bus node.

Preferably, a target list of the subscribers is implemented on the control unit, which contains at least in each case data on an identification number of a subscriber. The temporary subscriber is recognized by the control unit when, in a comparison of an identification number of the temporary subscriber with the identification numbers of the target list, a match is determined by the control unit.

The identification number represents a number by means of which a subscriber connected to the security system can be recognized; in particular, this number can represent a unique identification number for each subscriber or an identification number declaring a type of the subscriber. The identification number can be stored on a storage medium of the subscriber. The target list defines an expectation of the control unit, which participants should be connected to the security system. Accordingly, for each participant who works with the Security system is connectable, an entry in the target list. This entry includes at least one identification number. Thus, if the temporary subscriber is connected to the security system, the control unit checks whether this subscriber or his identification number is listed on the target list. If this check is positive or the identification number is included in the target list, the temporary participant is considered recognized.

Preferably, the detected temporary subscriber is integrated by the control unit by setting an entry of the recognized temporary subscriber in the target list by the control unit from an inactive to an active status. This can be accompanied by a change of the operating mode. Thus, an activation status can be stored on the target list for a temporary participant, which takes the participant in a certain operating mode. In this case, the control unit can be ready to change automatically when detecting the temporary participant in the operating mode, which is stored in the entry of the temporary participant as an active status in the target list.

Preferably, an actual list of subscribers is implemented on the control unit, which represents an image of the participants connected to the security system and operation of the elevator system is only enabled if the control unit in a comparison of activated in the target list participants with the in the actual List of registered subscribers a match is detected.

The actual list represents a list of all subscribers connected to the security system at any given time. Preferably, all recognized participants are listed by their identification numbers in the actual list. The comparison between the subscribers listed in the actual list with the subscribers deposited in the target list, in particular those who have an active status for a certain operating mode, is preferably carried out on the basis of the identification numbers listed in the two lists. This comparison ensures that all subscribers intended for a particular operating mode are connected to the security system before a corresponding operating mode is released.

Preferably, a temporary subscriber is identified by a first identification number representing a type of the temporary subscriber and / or a second identification number enabling a unique identification of the temporary subscriber by the control unit on the basis of a comparison of the first and / or second identification numbers of the temporary subscriber with the first and / or second identification numbers of the target list detected.

For example, a plurality of hand control devices may have the same first identification number because they are a device of the same type. By contrast, each hand control unit has a unique assigned second identification number.

Hand control device is here understood to mean a device for controlling the elevator installation, which is operated by a maintenance technician during maintenance work. This manual control unit preferably comprises four control elements, namely a button for performing a downward or upward travel, a button for triggering an emergency stop and a switch for activating or deactivating the maintenance mode.

Preferably, the security system is set by the control unit in a jamming mode when more than one temporary subscriber with the same first identification number is connected to the security system.

This can avoid a nonsensical combination of connected participants that could cause a potentially dangerous situation. For example, operation of the elevator installation can be prevented if two manual control devices are connected to the safety system at the same time. Connecting two handsets at the same time could lead to an input conflict of control commands or even jeopardize the safety of a service technician.

Preferably, the security system is enabled by the control unit for operation when the control unit recognizes the second identification number of the temporary subscriber from a group of second identification numbers stored on the target list.

In this case, in the target list of a security system or a control unit, a group of handsets with corresponding second identification numbers may be stored, which are assigned to a defined circle of maintenance technicians. For this group of handsets a maintenance work on the elevator system is released. It could thus be ensured that only a limited circle of maintenance technicians, for example members of a regional group of a company, can carry out maintenance work on a corresponding elevator installation. Thus, the proper maintenance condition of this elevator system can be guaranteed autonomously by the responsible regional group.

Preferably, in the event of a power failure, a system state of the security system is stored in a read-only memory of the control unit, in particular a desired list embodying a system state is stored.

Preferably, when the safety system is restarted after the power failure, the stored system state is compared by the control unit with the current system state, in particular the stored target list is compared with an updated actual list. The security system is set by the control unit in a fault mode, if the comparison establishes the absence of a temporary participant in the actual list.

This ensures that tampering with the security system does not go unnoticed during a power failure. The security system can thus determine, for example, whether a hand control unit has been removed during the power failure and prevents the shutdown of the elevator system a possible automatic transition to a normal operating mode.

Another aspect of the invention relates to a device for carrying out the method and an elevator installation with the said device.

Fig. 1

schematisch eine exemplarische Anordnung einer erfindungsgemässen Aufzugsanlage;

Fig. 2

eine exemplarische Ausführung einer Sollliste, die auf der Steuereinheit des Sicherheitssystems implementiert ist; und

Fig. 3

ein Flussdiagramm mit einem exemplarischen Ablauf eines Anmeldeverfahrens eines temporären Teilnehmers am Sicherheitssystem.

The invention will be further described by means of embodiments. Show it:

Fig. 1

schematically an exemplary arrangement of an elevator system according to the invention;

Fig. 2

an exemplary implementation of a target list implemented on the control unit of the security system; and

Fig. 3

a flowchart with an exemplary sequence of a registration procedure of a temporary subscriber to the security system.

The in the Fig. 1 schematically illustrated elevator installation 1 comprises a control unit 2, which is connected via a bus 3 to a plurality of bus nodes 41 to 49. The control unit 2 can as in Fig. 1 be shown in a separate drive space 8. In a preferred embodiment, the control unit 2 may also be arranged in a shaft 6.

The reference numeral 6 schematically shows a shaft 6 of a building in which the elevator installation 1 is installed. By way of example, the building has three floors, each floor being equipped with a landing door 61, 62 or 63. The bus node 41, the shaft door 61, the bus node 42, the shaft door 62 and the bus node 43, the shaft door 63 assigned.

The respective bus nodes 41, 42 or 43 are each assigned a subscriber, here for example a switching contact 61a, 62a, 63a, which records information relating to the state of the associated landing door 61, 62 or 63 (open, closed, locked) and possibly a fault message for the control unit 2 can generate.

The elevator installation 1 furthermore has an elevator cage 7. The elevator cage 7 is equipped with an elevator door 74, which is likewise assigned to a bus node 44. The bus node 44 is a further participant, such as another switch contact 74a assigned, which information regarding the state of the associated elevator door 74 (open, closed, locked) determines and possibly generate a fault message for the control unit 2.

The elevator installation 1 can furthermore have a bus node 45 and a bus node 46, to which further subscribers are assigned, namely one catching mechanism 75 arranged on the elevator car 7 and one emergency switch 76. The catching brake 75 serves for safety braking of the elevator car 7, for example upon reaching one Overspeed of the same. By operating the emergency switch 76, the elevator installation 1 can be brought to an immediate standstill in an emergency situation.

In a drive space 8, a drive unit is further arranged, which is equipped with two other participants, namely with an emergency brake 87 and a speed sensor 88, which are each assigned to a bus node 47 and 48. In a preferred embodiment, the drive unit may be arranged in the shaft 6, wherein a separate drive space is eliminated.

Furthermore, a bus node 49 is provided, which is arranged in the region of the shaft 6, and is designed to accommodate a temporary subscriber, namely a manual control device 89. The bus node 49 may in particular be arranged on the roof of the car 7 or in the pit of the shaft 1 or at one of the doors 61-63, depending on where the elevator installation 1 maintenance work is to be performed, which require a method of the elevator car 7. The temporary subscriber 89 is thus connected to the bus 3 or the control unit 2 via the bus node 49.

In the example shown, the temporary subscriber 89 can be connected to the bus 3 at a slot of the corresponding bus node 49. Alternatively, the temporary subscriber 89 can also be connected wirelessly to bus 3, for example via a WLAN, Bluetooth or another type of radio connection.

The hand control unit 89 is designed to control the elevator installation 1 or the elevator car 7 during a maintenance mode and comprises four control elements as an example, namely one button each for performing an upward or downward travel, a button for triggering an emergency stop and one Switch for activating or deactivating a maintenance mode.

The control unit 2 has a target list 5 a, which defines an expectation of the control unit 2. The target list 5a includes, for example, a listing which the Participants 61a-63a, 74a, 75, 76, 87, 88, 89 should be connected to the bus 3 at some point in time. In addition, the control unit 2 has an actual list 5b, which represents a listing of all subscribers 61a-63a, 74a, 75, 76, 87, 88, 89 currently connected to the bus 3.

Based on Fig. 2 the target list 5a is explained in more detail. The target list 5a comprises an entry for each participant contained therein. This entry corresponds to one row of the table. In a first column, a bus address ADD of a bus node 41 to 49 is stored, to which the respective subscriber 61a-63a, 74a, 75, 76, 87, 88, 89 is connected. Via the bus address ADD, the control unit 2 can communicate with a bus node 41 to 49 or a subscriber 61a-63a, 74a, 75, 76, 87, 88, 89 connected thereto. Accordingly, the control unit 2, for example, control signals to a corresponding subscriber, for example to the safety brake 75 via the bus address ADD, 45 address or specifically query states of the switch contact 61a at the bus ADD, 41.

In a second column, a first identification number ID1 of a subscriber 61a-63a, 74a, 75, 76, 87, 88, 89 is stored. This first identification number ID1 depends on the type of subscriber. Thus, subscribers 61a to 63b all logically have the same first identification number ID1 with the value SS, since all three subscribers are designed as type-identical switching contacts 61a to 63a which monitor the state of an associated hoistway door 61 to 63. A catch brake 75, however, has a deviating first identification number ID1 with the value UU.

The subscribers can also be identifiable via a second identification number ID2. This second identification number ID2 represents for each participant 61a-63a, 74a, 75, 76, 87, 88, 89 e.g. a number AAA to JJJ, which allows a unique identification of each participant 61a-63a, 74a, 75, 76, 87, 88, 89.

Finally, an activation value A or I is stored for each participant in the target list 5a, the activation value A representing an active status and the activation value I representing an inactive status of a subscriber. The target list 5a shown has respective activation values A, I for two different operating modes of the elevator installation 1, namely for a normal operating mode N and for a maintenance mode W. So For example, in the entry for the temporary subscriber 89 or the manual control unit, an activation value A for a maintenance mode W and an activation value I for a normal operation mode N are indicated. The manual control unit 89 is thus assigned an active status in maintenance mode W and an inactive status in normal operation mode N.

The temporary participant 89 is registered with the control unit 2 by first in a first step A according to the Fig. 3 the temporary subscriber 89 is connected to the bus 3 at the bus node 49. In a second step B, the control unit 2 recognizes the newly connected subscriber 89 on the basis of an identification number ID1, ID2 stored on a storage medium of the temporary subscriber 89. In the example shown, the first identification number ID1 indicates the type of the temporary subscriber 89, that is to say that this is the case is a manual control unit 89. The second identification number ID2 represents a unique identification number of the temporary participant 89. Thus, several manual control devices 89 can also be distinguished or assigned to a maintenance technician. Accordingly, a plurality of second identification numbers ID2 can also be stored for the entry of the manual control device 89 or, alternatively, one entry with a separate second identification number ID2 can be stored for each different manual control device 89.

In the example shown, a first identification number ID1 with the value YY and a second identification number ID2 with the value III are stored by way of example for the manual control unit 89. Thus, when a hand control device 89 having corresponding identification numbers ID1 and ID2 is connected to the bus 3, the control unit 2 reads out the values YY and III stored on the storage medium of the temporary subscriber 89 for the identification numbers ID1 and ID2 and compares them with those in the target list 5a listed YY and III. If there is a match, the participant 89 is considered recognized.

Furthermore, the manual control unit 89 is now integrated in a third step C by the control unit 2 in the system by the status of the manual control unit 89 is set in the entry of the target list 5a of inactive I to active A. For example, this may be accompanied by an automatic change of the operating mode, namely from a normal operating mode N to a maintenance mode W. Because of in the Set list 5a deposited activation values A, I of the temporary subscriber, the control unit 2 after detection of the manual control unit 89 automatically switch to the maintenance mode W. In addition, the control unit 2 is so programmable that in a fourth step D) the maintenance mode W is released only by pressing the activation switch on the manual control unit 89. After completion of the activation of the manual control unit 89 this is considered to be integrated in the security system.

The control unit 2 sets the elevator installation 2 in a disturbance mode if the actuation of the temporary participant 89 does not take place before the expiry of a predetermined time after insertion at the bus node 49. Likewise, the control unit 2 sets the elevator installation 2 in an interference mode when the temporary participant 89 is disconnected from the bus 3 after the login without further manipulation of the security system.

Optionally, the reliability when logging in the temporary subscriber 89 can be further increased by announcing the temporary subscriber 89 by means of a manipulation at the control unit 2 before the connection. The announcement can be made by inputting a control command at a designated entry point, which is connected via a bus node to the bus 3 or which is arranged directly on the control unit 2. Another way to announce the connection, is the operation of a switch. This switch can also be connected via a bus node to the bus 3 or be arranged directly on the control unit 2.

As a precaution, in this optional embodiment, the control unit 2 may place the elevator installation 1 in an interference mode if the temporary participant 89 is not connected to the bus 3 after the manipulation has expired before a predetermined time has elapsed. Likewise, the control unit 2 may set the elevator installation 1 in an interference mode if the temporary participant 89 is connected to the bus 3 before the manipulation.

In addition, in another embodiment, the elevator installation may have a display means. This display means is adapted to confirm the detection of the temporary subscriber 89. This confirmation indicates that the control unit 2 is ready to register the one-time operation of the temporary subscriber 89. The display means may for example be designed as an indicator light, which is integrated in a corresponding bus node 41-49.

The control unit 2 is further configured to set the elevator installation 1 in an interference mode when more than one temporary subscriber 89 with the same first identification number ID1 is connected to the bus 3. This can be prevented that, for example, two manual control units 89 are connected to the bus 3 simultaneously.

If the hand control unit 89 has been recognized and integrated, it can perform its intended function, namely the control of the elevator installation 1 during the maintenance mode W.

In addition, an actual list 5b of the subscribers 61a-63a, 74a, 75, 76, 87, 88, 89 is implemented on the control unit 2, which is an image of the subscribers 61a-63a, 74a connected to the security system 5b at some point in time. 75, 76, 87, 88, 89 represents. The actual list 5b is constructed very much like the target list 5a and substantially comprises the first four columns of the target list 5a. The control unit 2 thus reads for each existing bus node 41 to 49 or its address ADD and the identification numbers ID1, ID2 of the respective bus nodes 41 to 49 connected participants 61a-63a, 74a, 75, 76, 87, 88, 89 in the actual List 5b. The operation of the elevator installation 1 is only enabled by the control unit 2 if the control unit 2, in a comparison of the identification numbers ID1, ID2, in particular the identification numbers ID1, ID2 of the entries of the target list 5a, for the active status in a respective operating mode N, W is deposited with those of the actual list 5b determines a match.

In the event of a power failure, the system state of the elevator installation 1 is stored in a permanent memory of the control unit 2. In particular, the target list 5a is stored on the read-only memory, since the target list 5a represents such a system state. Namely, all participants 61a-63a, 74a, 75, 76, 87, 88, 89 are listed in the target list 5a, who should have an active status at some point in time.

When restarting the elevator installation 1 after the power failure, the stored target list 5a serves as a checklist. To determine if all present before the power failure temporary subscriber 89 still connected to the bus 3 are, the stored target list 5a is compared with the current actual list 5b after the power failure. If, on the basis of the comparison, the control unit 2 detects the absence of a temporary subscriber 89 in the actual list, the latter sets the elevator installation 1 into a fault mode.

Claims (15)

1. A method for operating a safety system of an elevator system (1) having

   - a control unit (2),

   - a bus (3),

   - a plurality of bus nodes (41-49) which are connected to the control unit (2) via the bus (3), and
   characterized by a plurality of subscribers (61a-63a, 74a, 75, 76, 87, 88, 89), of which at least one subscriber is designed as a temporary subscriber (89), that are connected to the control unit (2) via a bus node (41-49), wherein

   - the temporary subscriber (89) is registered in the safety system by

   - A) the temporary subscriber (89) being connected to the safety system at a bus node (49),

   - B) the temporary subscriber (89) being recognised by the control unit (2)

   - C) the temporary subscriber (89) being integrated into the safety system by the control unit (2) and

   - D) the temporary subscriber (89) being activated at least once.
2. The method according to claim 1, wherein
   the control unit (2) places the safety system in a fault mode if, after connecting to the safety system the temporary subscriber (89) is not activated before a specified period of time has elapsed, or if the temporary subscriber (89) is disconnected from the safety system after the registration without further manipulation of the safety system.
3. The method according to claim 1, wherein
   the temporary subscriber (89) is registered in the safety system by the temporary subscriber (89) being notified to the control unit (2) before the connection by means of a manipulation of the safety system, in particular by the input of a control command at a designated input point for the purpose, or by the activation of a switch, wherein the input point or the switch are each connected to the safety system.
4. The method according to claim 3, wherein
   the control unit (2) places the safety system in a fault mode if after the manipulation of the safety system, the temporary subscriber (89) is not connected to the safety system before a specified period of time has elapsed, or if the temporary subscriber (89) is connected to the safety system before the manipulation of the safety system.
5. The method according to claim 1, wherein
   the recognition and integration of the temporary subscriber (89) is confirmed by means of a display medium.
6. The method according to claim 1, wherein
   on the control unit (2) a reference list (5a) of the subscribers (61a-63a, 74a, 75, 76, 87, 88, 89) is implemented, said list containing at least data relating to an identification number (ID1, ID2) of a subscriber (61a-63a, 74a, 75, 76, 87, 88, 89), and the temporary subscriber (89) is recognized by the control unit (2) if a match is found by the control unit (2) during a comparison of an identification number (ID1, ID2) of the temporary subscriber (89) with the identification numbers (ID1, ID2) of the reference list (5a).
7. The method according to claim 6, wherein
   the recognised temporary subscriber (89) is integrated by the control unit (2) by an entry of the recognised temporary subscriber (89) in the reference list (5a) being changed by the control unit (2) from an inactive (I) to an active status (A).
8. The method according to claim 7, wherein
   on the control unit (2) an actual list (5b) of the subscribers (61a-63a, 74a, 75, 76, 87, 88, 89) is implemented, which represents an image of the subscribers (61a-63a, 74a, 75, 76, 87, 88, 89) connected to the safety system, and an operation of the lift system (1) is enabled only if a match is found by the control unit (2) during a comparison of the subscribers (61a-63a, 74a, 75, 76, 87, 88, 89) activated in the reference list (5a) with the subscribers (61a-63a, 74a 75, 76, 87, 88, 89) entered in the actual list (5b).
9. The method according to claim 6, wherein
   a temporary subscriber (89) is recognised by the control unit (2) by means of a first identification number (ID1) representing a type of the temporary subscriber (89) and/or by a second identification number (ID2) enabling a unique identification of the temporary subscriber (89) as a result of a comparison of the first and/or second identification number (ID1, ID2) of the temporary subscriber (89) with first and/or second identification numbers (ID1, ID2) of the reference list (5a).
10. The method according to claim 9, wherein
    the safety system is placed in a fault mode by the control unit (2) if more than one temporary subscriber (89) with the same first identification number (ID1) is connected to the safety system.
11. The method according to claim 9, wherein
    the safety system is enabled by the control unit (2) for an operation if the control unit (2) recognises the second identification number (ID2) of the temporary subscriber (89) from a group of second identification numbers (ID2) that are stored on the reference list (5a).
12. The method according to any one of the previous claims, wherein
    in the event of a power failure a system status of the safety system is saved in a fixed memory of the control unit (2), in particular a reference list (5a) embodying a system status is saved.
13. The method according to claim 12, wherein
    at the time of re-installation of the safety system after the power failure the saved system status is compared by the control unit (2) with the current system status, in particular the saved reference list (5a) is compared with an actual list (5b), and
    the safety system is placed in a fault mode by the control unit (2) if, as a result of the comparison, the absence of a temporary subscriber (89) in the actual list (5b) is detected.
14. A safety system for an elevator system (1), having

    - a control unit (2),

    - a bus (3),

    - a plurality of bus nodes (41-49) which are connected to the control unit (2) via the bus (3), and

    characterized by a plurality of subscribers (61a-63a, 74a, 75, 76, 87, 88, 89), of which at least one subscriber is designed as a temporary subscriber (89), that are connected to the control unit (2) via a bus node (41-49), wherein the safety system is designed to implement the method according to any of claims 1 to 13.
15. An elevator system (1) having a safety system according to claim 14.

Images