EP4638330A1

EP4638330A1 - Testing unintended car movement in an elevator system

Info

Publication number: EP4638330A1
Application number: EP22843765.3A
Authority: EP
Inventors: Juha-Matti Aitamurto; Lauri Stolt; Juhamatti Nikander
Original assignee: Kone Corp
Current assignee: Kone Corp
Priority date: 2022-12-22
Filing date: 2022-12-22
Publication date: 2025-10-29
Also published as: WO2024132154A1; CN120303205A

Abstract

According to an aspect, there is provided an elevator system comprising an elevator car configured to operate between landing floors, a hoisting machinery configured to drive the elevator car; at least one hoisting machinery brake configured to stop movement of the elevator car; an elevator controller configured to control the drive to move the elevator car during a normal elevator operation mode; a plurality of safety sensors configured to provide safety information associated with the elevator car; and a safety system configured to receive safety information from the plurality of safety sensors. The elevator controller is configured to determine that one or more predetermined operational conditions for an unintended car movement test are fulfilled, and in response to the determination, cause at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection. The safety system is configured to detect the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors, and initiate stopping of the elevator car in response to the detection.

Description

TESTING UNINTENDED CAR MOVEMENT IN AN ELEVATOR SYSTEM

TECHNICAL FIELD

Various example embodiments generally relate to the field of elevator systems . In particular, some example embodiments relate to a solution for ensuring a safe elevator operation in an unintended car movement situation .

BACKGROUND

Elevators have electromechanical hoisting machinery brakes as safety devices to apply a braking force to a traction sheave or a rotating axis of an elevator hoisting machinery . There is at least one , commonly at least two separate brakes acting on the same hoisting machinery . These brakes are designed to hold an elevator car at standstill at a landing floor .

Elevators may also be equipped with an unintended car movement protection device , which provides a secure stopping of the elevator car in case undesired movement of the elevator car away from a landing with doors open has been detected . Such undesired movement may be a consequence of , for example , an elevator control system failure , and it could potentially be dangerous for elevator users entering or exiting the car . Therefore , it is important that the unintended car movement protection is functional and operates correctly .

Consequently, there is a need for ensuring a safe elevator operation in an unintended car movement situation .

SUMMARY

According to a first aspect , there is provided an elevator system . The elevator system comprises an elevator car configured to operate between landing floors ; a hoisting machinery configured to drive the elevator car ; at least one hoisting machinery brake configured to stop movement of the elevator car ; an elevator controller configured to control the drive to move the elevator car during a normal elevator operation mode ; a plurality of safety sensors configured to provide safety information associated with the elevator car, and a safety system configured to receive safety information from the plurality of safety sensors . The elevator controller is configured to determine that one or more predetermined operational conditions for an unintended car movement test are ful filled, and in response to the determination, cause at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection . The safety system is configured to detect the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors , and initiate stopping of the elevator car in response to the detection .

In an implementation form of the first aspect , the elevator system comprises a positioning system configured to provide an elevator car position in an elevator shaft , and the elevator controller is configured to determine a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car based on data from the positioning system, and determine a working condition of the unintended car movement detection based on the distance .

In an implementation form of the first aspect , the drive is configured to determine a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car ; and the elevator controller is configured to determine a working condition of the unintended car movement detection based on the distance .

In an implementation form of the first aspect , the elevator controller is configured to compare the distance to a first threshold distance , and take the elevator car out of service i f the di stance is greater than the first threshold distance .

In an implementation form of the first aspect , the elevator controller is configured to compare the distance to a second threshold distance , and issue a warning signal i f the distance is greater than the second threshold distance .

In an implementation form of the first aspect , when causing at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection, the elevator controller is configured to open the at least one hoisting machinery brake at the initial test location without supplying power to the hoisting motor .

In an implementation form of the first aspect , when causing at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection, the elevator controller is configured to open the at least one hoisting machinery brake at the initial test location, and supply power to the hoisting motor to move the elevator car .

In an implementation form of the first aspect , the one or more predetermined operational conditions comprise at least one of the following : the elevator car is empty; the elevator car has a test load; the unintended car movement test is accepted by the elevator controller and the safety system; the elevator controller receives a test request ; and a predetermined test time period is triggered .

According to a second aspect , there is provided a method for testing unintended movement of an elevator car of an elevator system comprising an elevator car configured to operate between landing floors , a hoisting machinery configured to drive the elevator car, at least one machinery brake configured to stop movement of the elevator car, an elevator controller configured to control the drive to move the elevator car during a normal elevator operation mode , a plurality of safety sensors configured to provide safety information associated with the elevator car, and a safety system configured to receive safety information from the plurality of safety sensors . The method comprises determining, by the elevator control ler, that one or more predetermined operational conditions for an unintended car movement test are ful filled; in response to the determination, causing, by the elevator controller, at least one o f the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection; detecting, by the safety system, the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors ; and initiating, by the safety system, stopping of the elevator car in response to the detection .

In an implementation form of the second aspect , the elevator system comprises a positioning system configured to provide an elevator car position in an elevator shaft , and wherein the method further comprises determining, by the elevator controller, a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car based on data from the positioning system; and determining, by the elevator controller, a working condition of the unintended car movement detection based on the distance .

In an implementation form of the second aspect , the method further comprises determining, by the drive , a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car ; and determining, by the elevator controller, a working condition of the unintended car movement detection based on the distance .

In an implementation form of the second aspect , the method further comprises comparing, by the elevator controller, the distance to a first threshold distance ; and taking, by the elevator controller, the elevator car out of service i f the distance is greater than the first threshold distance .

In an implementation form of the second aspect , the method further comprises comparing, by the elevator controller, the distance to a second threshold distance ; and issuing, by the elevator controller, a warning signal i f the distance is greater than the second threshold distance .

In an implementation form of the second aspect , causing, by the elevator controller at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection comprises opening, by the elevator controller, the at least one hoisting machinery brake at the initial test location without supplying power to the hoisting machinery . In an implementation form of the second aspect , causing, by the elevator controller, at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection comprises opening, by the elevator controller, the at least one hoisting machinery brake at the initial test location; and supplying, by the elevator controller, power to the hoisting machinery to move the elevator car .

In an implementation form of the second aspect , the one or more predetermined operational conditions comprise at least one of the following : the elevator car is empty; the elevator car has a test load; the unintended car movement test is accepted by the elevator controller and the safety system; the elevator controller receives a test request ; and a predetermined test time period is triggered .

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings , which are included to provide a further understanding of the invention and constitute a part of this speci fication, illustrate embodiments of the invention and together with the description help to explain the principles of the invention . In the drawings :

FIG . 1 illustrates a system according to an example embodiment .

FIG . 2 illustrates a graph representing elevator car speed during an unintended car movement according to an example embodiment . FIG . 3 illustrates a flow diagram for testing unintended movement of an elevator car of an elevator system according to an example embodiment .

DETAILED DESCRIPTION

Various examples and embodiments discussed herein di sclose a solution in which a safe elevator operation in an unintended car movement situation may be enabled .

FIG . 1 illustrates a system according to an example embodiment . The elevator system comprises an elevator controller 100 configured to control a drive 102 to move an elevator car in an elevator shaft during a normal elevator operation mode and at least one hoisting machinery brake 104 . In an example embodiment , there may be at least two , four or even more machinery brakes . The drive 102 is configured to control the hoisting machinery 108 to drive the elevator car between landing floors in the elevator shaft . The elevator system further comprises a safety system 110 configured to control the elevator controller 100 and the drive 102 . The safety system 110 is also configured to receive safety information associated with the elevator car from a plurality of safety sensors 112 .

The elevator controller 100 is configured to determine that one or more predetermined operational conditions for an unintended car movement test are ful fi lled, and in response to the determination, cause at least one of the hoisting machinery 108 and the hoisting machinery brakes 104 to initiate an unintended car movement detection . In other words , the elevator controller 100 is configured to initiate the unintended car movement on purpose to test how the elevator system responds to it . The safety system 110 is configured to detect the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors . The safety sensors may comprise , for example , at least one of a car encoder measuring elevator car movement , a motor encoder measuring rotation of elevator hoisting machine , a door zone sensor ( s ) measuring position of elevator car in the proximity of landing floor, a safety contact measuring open/closed state of landing door and/or car door, a limit switch or corresponding sensor measuring arrival of the car to a predetermined point in elevator shaft , a brake switch or corresponding sensor measuring closed/open state of hoisting machinery brake ( s ) etc . In response to the detection, the safety system 110 is configured to initiate stopping of the elevator car . For example , the safety system 110 may be configured to control the drive 102 to stop the elevator car and/or to control the elevator controller 100 to apply the hoisting machinery brakes 104 .

In an example embodiment , the safety system 110 may comprise , for example, a programmable electronic safety controller, and the unintended car movement detection function may be implemented in safety software of the electronic safety controller . The safety controller may run the unintended car movement detection function as an independent software subroutine , configured to remain unaf fected even i f other functions or memory locations of the safety controller are manipulated . For example , it is possible that a software open of a landing door safety contact is made in the safety controller software to simulate open landing door contact during unintended car movement test , instead of actually opening the landing door . Therefore , as the landing door does not have to be opened, elevator safety may be improved . The safety controller may cause a safety shutdown of the elevator by generating a control command, which causes the hoisting machinery brakes to be applied and power supply of the hoisting motor to be interrupted .

In an example embodiment , the elevator system may comprise a positioning system configured to provide an elevator car position in an elevator shaft . The elevator controller 100 may be configured to determine a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car based on data from the positioning system . In another example embodiment , the drive 102 may be configured to determine a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car . The elevator controller 100 may then be configured to determine a working condition of the unintended car movement detection based on the distance . The elevator controller 100 may be configured to compare the distance to a first threshold distance , and take the elevator car out of service i f the distance is greater than the first threshold distance . The first threshold distance may be set to a value that indicates that the unintended car movement detection does not function properly, and thus additional maintenance actions may be immediately required . In another example embodiment , the elevator controller 100 may be configured to compare the distance to a second threshold distance , and issue a warning signal i f the distance is greater than the second threshold distance . The second threshold distance may be set to a value that is less than the value of the first threshold distance , and it may be used as means for providing a warning signal . In response to the warning signal , a maintenance visit to the elevator site may be requested without interrupting the elevator system service . In an example embodiment , when causing at least one of the hoisting machinery 108 and the hoisting machinery brakes 104 to initiate an unintended car movement detection, the elevator controller 100 may be configured to open the hoisting machinery brakes 104 at the initial test location without supplying power to the hoisting machinery 108 . In other words , the elevator car starts to move upwards in the elevator shaft because the counterweight is heavier than the elevator car . In another example embodiment , when causing at least one of the hoisting machinery 108 and the hoisting machinery brakes 104 to initiate an unintended car movement detection, the elevator controller 100 may be configured to open the hoisting machinery brakes 104 at the initial test location and supply power to the hoisting machinery 108 to move the elevator car .

The one or more operational conditions may compri se at least one o f the fol lowing : the elevator car is empty; the elevator car has a test load; the unintended car movement test is accepted by the elevator controller 100 and the safety system 110 ; the elevator controller 100 receives a test request ; and a predetermined test time period i s triggered . The emptiness o f the elevator car may be determined, for example, based on a visual check or data from at least one of a camera, a load weighing device , proximity sensor and presence sensor . The predetermined test time period may be selected so that the unintended car movement detection is tested regularly, for example , once a day, once a week etc . Further, in an example embodiment , the predetermined test time period may be adaptive . For example , i f the distance from the initial test location of the elevator car to the stopping location of the elevator car after stopping of the elevator car remains substantially constant and is under a predetermined threshold, the predetermined test time period may be longer . Then, when it is determined that the distance starts to grow, the predetermined test time period may be set to a shorter time interval . The test request may be generated, for example , with a manual control panel , or it may be received from a prede fined network address in a remote location, such as a server or a remotely located elevator service centre . In another example embodiment , the test request may be generated locally automatically at an elevator site based on a predetermined schedule , such as a week clock etc . The test request may be received by the safety system 110 , which then sends the test request to the elevator controller 100 , for example , via a redundant communication channel therebetween .

FIG . 2 illustrates a graph representing elevator car speed during an unintended car movement according to an example embodiment . The graph may be a result of an unintended car movement test of an elevator car . There may be or more prerequisites for the unintended car movement test , for example one or more of the following :

The elevator car has no persons ins ide . This may be confirmed, for example , by a visual check or based on data received from a camera, a load weighting device , a proximity sensor or a presence sensor .

The elevator car has a test load only .

The unintended car movement test is triggered from a user interface or based on at least one predetermined condition, for example a time interval or from a speci fied remote location .

The unintended car movement test is accepted by a mutual acceptance between the drive and the safety system : o The safety system may send a unintended car movement test request to the drive , for example , using two communication di f ferent channels or in single channel system as two redundant messages. o The drive receives the request and prepares a test condition, if redundant test requests conform with each other. o The drive responds to the safety system with a prepared test condition. o If the safety system receives the prepared test condition message from the drive even if the safety system has requested the test, the safety system can move the elevator system to safe state and prevent a start of the elevator car .

When the test condition has been established, the unintended car movement test can be initiated at 200, for example, via a user interface.

The result of the test may be reported to a remote entity, such as a service center, or it may be reported locally on-site, for example, on a display of an elevator controller or a mobile device carried by a service technician.

In a first example of FIG. 2, when the unintended car movement test has been initiated, the drive keeps the elevator car at a landing or at a predefined test location, and hoisting machinery brakes are opened. After a predetermined time, the drive may remove power (i.e. torque) from the hoisting machinery and disables dynamic braking. In another example embodiment, the drive may apply test power (i.e. torque) to the hoisting machinery after a predetermined time. The test torque may be limited to a nominal current or lower in case a maximum acceleration is reached (for example, 2.5 m/s²) . The elevator car starts to move and accelerate due a load unbalance between the elevator car and the counterweight associated with the elevator car or due to the test power . The safety system is configured to detect the unintended car movement at 202 , for example , based on safety information from at least one safety sensor, and open a safety output . The power supply to the hoisting machinery and the hoisting machine brakes is removed at the start of 204 . Due to this , the hoisting machinery brakes make contact to a traction sheave and start to produce a decelerating torque at 206 . Thus , the elevator car speed slows and the movement of the elevator car eventually stops at 208 .

In a second example o f FIG . 2 , when the unintended car movement test has been initiated, the drive keeps the elevator car at a landing or at a predefined test location, and hoisting machinery brakes are opened . The drive may request an unintended car movement protection (UCMP ) stop from the safety system . The safety system reacts to the UCMP request and opens safety output at 202 . The power supply to hoisting machinery and the hoisting machine brakes is removed at the start of 204 . The elevator car starts to move and accelerate due a load unbalance between the elevator car and the counterweight associated with the elevator car . The hoisting machine brakes make contact to the traction sheave and start to produce a decelerating torque at 206 . Thus , the elevator car speed slows and the movement of the elevator car eventually stops at 208 .

In the first and/or second example , the drive may be conf igured to run the elevator car back to the landing or the predefined test location and measure the run distance . The run distance is equal to an unintended car movement stopping distance . The distance may be compared to an allowed reference value , for example , a first threshold value . The elevator controller 100 may be configured to compare the distance to the allowed reference value , and take the elevator car out of service i f the distance is greater than the allowed reference value . The allowed reference value may be set to a value that indicates that the unintended car movement detection does not function properly, and thus additional maintenance actions may be immediately required . In another example embodiment , the elevator controller 100 may be configured to compare the distance to a second threshold distance , and issue a warning signal i f the distance is greater than the second threshold distance . The second threshold distance may be set to a value that is less than the value of the first threshold distance , and it may be used as means for providing a warning signal . In response to the warning signal , a maintenance visit to the elevator site may be requested without interrupting the elevator system service . As an alternative to measuring the distance with the drive , the distance may be determined based on data from an elevator car positioning system using, for example , sensor data from sensors in the elevator shaft and/or the elevator car .

In an example embodiment , there can a supplementary protection function in case it has been detected that the stopping is not initiated by the safety system as required . In this case , the drive may be configured to drop the hoisting machinery brakes and remove the test torque from the hoisting machinery i f applicable after the distance of the elevator car from test location has exceeded a predefined distance, for example , one meter .

FIG . 3 illustrates a flow diagram for testing unintended movement of an elevator car of an elevator system according to an example embodiment . The elevator system comprises an elevator car configured to operate between landing floors , a hoisting machinery configured to drive the elevator car, at least one machinery brake configured to stop movement of the elevator car, an elevator controller configured to control the drive to move the elevator car during a normal elevator operation mode , a plurality of safety sensors configured to provide safety information associated with the elevator car, and a safety system configured to receive safety information from the plurality of safety sensors .

At 300 the elevator controller may determine that one or more predetermined operational conditions for an unintended car movement test are ful filled .

At 302 , in response to the determination, the elevator controller may cause at least one of the hoisting machinery and the at least one hoisting machinery brake to initiate an unintended car movement detection .

At 304 the safety system may detect the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors .

At 306 the safety system may initiate stopping of the elevator car in response to the detection .

One or more of the examples and example embodiments discussed above may enable a solution for simulating and veri fying a correct operation of unintended car movement protection in an elevator system . The solution may be applied even in elevator solutions in which elevator hoisting and machinery properties are unknown or not known in detail . Further, one or more of the examples and example embodiments discussed above may enable a simple and safe solution for demonstrating a correct operation of an unintended car movement protection . Further, one or more of the examples and example embodiments discussed above may enable a simple and safe solution for monitoring changes in the unintended car movement protection by periodic test intervals . One or more o f the apparatuses of the elevator system, for example , the safety system and the elevator controller, may be implemented by an apparatus , for example , a computer or a controller . The apparatus may comprise one or more processors , and one or more memories that comprise computer program code . The apparatus may also include at least one communication interface configured to provide wireless and/or wired connectivity . In an example embodiment , the memory is capable of storing instructions , such as an operating system and/or various applications .

Furthermore , the processor is capable of executing the stored instructions . In an example embodiment , the processor may be embodied as a multi-core processor, a single core processor, or a combination of one or more multi-core processors and one or more single core processors . For example , the processor may be embodied as one or more of various processing devices , such as a coprocessor, a microprocessor, a controller, a digital signal processor ( DSP ) , a processing circuitry with or without an accompanying DSP, or various other processing devices including integrated circuits such as , for example , an application specific integrated circuit (AS IC ) , a field programmable gate array ( FPGA) , a microcontroller unit (MCU) , a hardware accelerator, a special-purpose computer chip, or the like . In an example embodiment , the processor may be configured to execute hard-coded functionality . In an example embodiment , the processor is embodied as an executor of software instructions , wherein the instructions may speci fically configure the processor to perform the algorithms and/or operations described herein when the instructions are executed . The memory may be embodied as one or more volatile memory devices, one or more non-volatile memory devices, and/or a combination of one or more volatile memory devices and non-volatile memory devices. For example, the memory may be embodied as semiconductor memories (such as mask ROM, PROM (programmable ROM) , EPROM (erasable PROM) , flash ROM, RAM (random access memory) , etc.) .

In an embodiment, the at least one memory may store program instructions that, when executed by the at least one processor, cause the apparatus to perform the functionality of the various embodiments discussed herein. Further, in an embodiment, at least one of the processor and the memory may constitute means for implementing the discussed functionality.

Example embodiments may be implemented in software, hardware, application logic or a combination of software, hardware and application logic. The example embodiments can store information relating to various methods described herein. This information can be stored in one or more memories, such as a hard disk, optical disk, magneto-optical disk, RAM, and the like. One or more databases can store the information used to implement the example embodiments. The databases can be organized using data structures (e.g., records, tables, arrays, fields, graphs, trees, lists, and the like) included in one or more memories or storage devices listed herein. The methods described with respect to the example embodiments can include appropriate data structures for storing data collected and/or generated by the methods of the devices and subsystems of the example embodiments in one or more databases.

The components of the example embodiments may include computer readable medium or memories for holding instructions programmed according to the teachings and for holding data structures , tables , records , and/or other data described herein . In an example embodiment , the application logic, software or an instruction set is maintained on any one of various conventional computer-readable media . In the context of this document, a "computer-readable medium" may be any media or means that can contain, store , communicate , propagate or transport the instructions for use by or in connection with an instruction execution system, apparatus , or device , such as a computer . A computer- readable medium may include a computer-readable storage medium that may be any media or means that can contain or store the instructions for use by or in connection with an instruction execution system, apparatus , or device , such as a computer . A computer readable medium can include any suitable medium that participates in providing instructions to a processor for execution . Such a medium can take many forms , including but not limited to , non-volatile media, volatile media, transmission media, and the like .

While there have been shown and described and pointed out fundamental novel features as applied to preferred embodiments thereof , it will be understood that various omissions and substitutions and changes in the form and details of the devices and methods described may be made by those skilled in the art without departing from the spirit o f the disclosure . For example , it is expres sly intended that all combinations of those elements and/or method steps which perform substantially the same function in substantially the same way to achieve the same results are within the scope of the disclosure . Moreover, it should be recogni zed that structures and/or elements and/or method steps shown and/or described in connection with any disclosed form or embodiments may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice . Furthermore , means-plus- function clauses are intended to cover the structures described herein as performing the recited function and not only structural equivalents , but also equivalent structures .

The applicant hereby discloses in isolation each individual feature described herein and any combination of two or more such features , to the extent that such features or combinations are capable of being carried out based on the present speci fication as a whole , in the light of the common general knowledge of a person skilled in the art , irrespective of whether such features or combinations of features solve any problems disclosed herein, and without limitation to the scope of the claims . The applicant indicates that the disclosed aspects/embodiments may consist of any such individual feature or combination of features . In view of the foregoing description it will be evident to a person skilled in the art that various modi fications may be made within the scope of the disclosure .

Claims

1. An elevator system comprising: an elevator car configured to operate between landing floors; a hoisting machinery (108) configured to drive the elevator car; at least one machinery brake (104) configured to stop movement of the elevator car; an elevator controller (100) configured to control the drive to move the elevator car during a normal elevator operation mode; a plurality of safety sensors (112) configured to provide safety information associated with the elevator car; a safety system (110) configured to receive safety information from the plurality of safety sensors (112) ; wherein the elevator controller (100) is configured to: determine that one or more predetermined operational conditions for an unintended car movement test are fulfilled; and in response to the determination, cause at least one of the hoisting machinery (108) and the at least one hoisting machinery brake (104) to initiate an unintended car movement detection; wherein the safety system (110) is configured to : detect the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors (112) ; and initiate stopping of the elevator car in response to the detection.

2. The elevator system of claim 1, wherein the elevator system comprises a positioning system configured to provide an elevator car position in an elevator shaft, and the elevator controller (100) is configured to: determine a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car based on data from the positioning system; and determine a working condition of the unintended car movement detection based on the distance.

3. The elevator system of claim 1, wherein: the drive (102) is configured to determine a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car; and the elevator controller (100) is configured to determine a working condition of the unintended car movement detection based on the distance.

4. The elevator system of claim 2 or 3, the elevator controller (100) is configured to: compare the distance to a first threshold distance; and take the elevator car out of service if the distance is greater than the first threshold distance.

5. The elevator system of claim 2 or 3, the elevator controller (100) is configured to: compare the distance to a second threshold distance; and issue a warning signal if the distance is greater than the second threshold distance.

6. The elevator system of any of claims 1 - 5, wherein when causing at least one of the hoisting machinery (108) and the at least one hoisting machinery brake (104) to initiate an unintended car movement detection, the elevator controller (100) is configured to : open the at least one hoisting machinery brake (104) at the initial test location without supplying power to the hoisting machinery (108) .

7. The elevator system of any of claims 1 - 5, wherein when causing at least one of the hoisting machinery (108) and the at least one hoisting machinery brake (104) to initiate an unintended car movement detection, the elevator controller (100) is configured to : open the at least one hoisting machinery brake (104) at the initial test location; and supply power to the hoisting machinery (108) to move the elevator car.

8. The elevator system of any of claims 1 - 7, wherein the one or more predetermined operational conditions comprise at least one of the following: the elevator car is empty; the elevator car has a test load; the unintended car movement test is accepted by the elevator controller (110) and the safety system (110) ; the elevator controller (100) receives a test request; and a predetermined test time period is triggered.

9. A method for testing unintended movement of an elevator car of an elevator system comprising an elevator car configured to operate between landing floors, a hoisting machinery (108) configured to drive the elevator car, at least one machinery brake (104) configured to stop movement of the elevator car, an elevator controller (100) configured to control the drive to move the elevator car during a normal elevator operation mode, a plurality of safety sensors (112) configured to provide safety information associated with the elevator car, and a safety system (110) configured to receive safety information from the plurality of safety sensors (112) ; wherein the method comprises: determining, by the elevator controller (100) , that one or more predetermined operational conditions for an unintended car movement test are fulfilled; in response to the determination, causing, by the elevator controller (100) , at least one of the hoisting machinery (108) and the at least one hoisting machinery brake (104) to initiate an unintended car movement detection; detecting, by the safety system (110) , the unintended car movement based on safety information received from at least one sensor of the plurality of safety sensors (112) ; and initiating, by the safety system (110) , stopping of the elevator car in response to the detection .

10. The method of claim 9, wherein the elevator system comprises a positioning system configured to provide an elevator car position in an elevator shaft, and wherein the method further comprises: determining, by the elevator controller (100) , a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car based on data from the positioning system; and determining, by the elevator controller (100) , a working condition of the unintended car movement detection based on the distance.

11. The method of claim 9, further comprising: determining, by the drive (102) , a distance from an initial test location of the elevator car to a stopping location of the elevator car after stopping of the elevator car; and determining, by the elevator controller (100) , a working condition of the unintended car movement detection based on the distance.

12. The method of claim 10 or 11, further comprising : comparing, by the elevator controller (100) , the distance to a first threshold distance; and taking, by the elevator controller (100) , the elevator car out of service if the distance is greater than the first threshold distance.

13. The method of claim 10 or 11, further comprising : comparing, by the elevator controller (100) , the distance to a second threshold distance; and issuing, by the elevator controller (100) , a warning signal if the distance is greater than the second threshold distance.

14. The method of any of claims 9 - 13, wherein causing, by the elevator controller (100) at least one of the hoisting machinery (108) and the at least one hoisting machinery brake (104) to initiate an unintended car movement detection comprises: opening, by the elevator controller (100) , the at least one hoisting machinery brake (104) at the initial test location without supplying power to the hoisting machinery (108) .

15. The method of any of claims 9 - 14, wherein causing, by the elevator controller, at least one of the hoisting machinery (108) and the at least one hoisting machinery brake (104) to initiate an unintended car movement detection comprises: opening, by the elevator controller (100) , the at least one hoisting machinery brake (104) at the initial test location; and supplying, by the elevator controller (100) , power to the hoisting machinery (108) to move the elevator car.

16. The method of any of claims 9 - 15, wherein the one or more predetermined operational conditions comprise at least one of the following: the elevator car is empty; the elevator car has a test load; the unintended car movement test is accepted by the elevator controller (100) and the safety system (110) ; the elevator controller (100) receives a test request; and a predetermined test time period is triggered.