DE102023101818A1 - Elevator system for transporting people and/or goods - Google Patents

Abstract

The present invention relates to an elevator system (1, 1.1, 1.2) for transporting people and/or goods, comprising at least one elevator shaft (2.1, 2.2), at least one elevator car (3.1, 3.2, 3.3) that can be moved along the elevator shaft (2.1, 2.2) between several landing positions (4.1, 4.2, 4.3, 4.4), and a control unit (10.1, 10.2) for controlling the elevator car (3.1, 3.2, 3.3), wherein the control unit (10.1, 10.2) is designed to receive control requests for moving the elevator car (3.1, 3.2, 3.3) from at least one terminal (15.1, 15.2, 15.3, 15.4, 15.5) via a network, and wherein the control unit (10.1, 10.2) is designed to check a control request for at least one condition and to move the elevator car (3.1, 3.2, 3.3) between the landing positions (4.1, 4.2, 4.3, 4.4) if the at least one condition of the control request is met. The present invention further relates to a method (20) for operating such an elevator system (1, 1.1, 1.2), a computer program product and a computer-readable medium.

Description

Technical area

The present invention relates to an elevator system for transporting persons and/or goods, comprising at least one elevator shaft, at least one elevator car that can be moved along the elevator shaft between several landing positions, and a control unit for controlling the elevator car.

Furthermore, the present invention relates to a method for operating such an elevator system.

Furthermore, the present invention relates to a computer program product for carrying out the method and to a computer-readable medium on which the computer program product is stored.

Background of the invention

Elevator systems are widely known from the prior art and usually include control panels in the elevator car and in the area of landing positions, for example next to a landing door, for selecting a desired landing position by a person who has boarded the elevator car or for calling a elevator car from such a landing position. It is also known to supplement the function of such control panels with digital equivalents on a terminal device, in particular an app on a smartphone. For this purpose, a connection for transmitting control requests is established via a network between the elevator system, in particular its control unit, and a terminal device located near the elevator system. The disadvantage of such network connections, however, is that they are susceptible to misuse and hacker attacks.

Description of the invention

Based on this situation, it is an object of the present invention to propose an elevator installation in which control via a terminal is possible in a safe manner.

The object of the invention is achieved by the features of the independent main claims. Advantageous embodiments are specified in the subclaims. If technically possible, the teachings of the subclaims can be combined as desired with the teachings of the main and subclaims.

In particular, the object is accordingly achieved by an elevator system for transporting people and/or goods, comprising at least one elevator shaft, at least one elevator car that can be moved along the elevator shaft between a plurality of landing positions, and a control unit for controlling the elevator car, wherein the control unit is configured to receive control requests for moving the elevator car from at least one terminal via a network and wherein the control unit is configured to check a control request for at least one condition and to move the elevator car between the landing positions accordingly if the at least one condition of the control request is met.

Advantageous aspects of the claimed invention are explained below and preferred modified embodiments of the invention are described further below. Explanations, in particular regarding advantages and definitions of features, are basically descriptive and preferred, but not limiting examples. If an explanation is limiting, this is expressly mentioned.

An elevator shaft of the elevator system can extend in a vertical and/or horizontal direction. In one embodiment, the elevator system has at least one partial section of the elevator shaft in which it extends vertically and at least one partial section in which the elevator shaft extends horizontally, wherein the elevator car can move from the vertically extending section into the horizontally extending section.

In a landing position, the car is designed to stop and allow people to board/disembark or load/unload goods. The landing position is usually on a floor or in an area of a building, with a landing door provided in a wall of the elevator shaft and a car door on the car, and with the doors aligned with each other in the landing position to form a passage between the car and the floor or area.

The at least one car of the elevator system can be driven, for example, by means of a support means, such as a rope, a belt or a chain, with a drive acting on the support means for this purpose, and with the support means preferably also being connected to a counterweight. The car is alternatively driven without a support means, for example hydraulically, pneumatically or by means of a linear motor. A linear motor is formed, for example, from a primary part extending along the elevator shaft and a secondary part located on the car.

In the sense of the present invention, an elevator system is already formed by a single elevator shaft with a single car that can be moved therein, but can also have, for example, several cars in the single elevator shaft or several elevator shafts, each with a single car or several cars. An elevator system with several elevator shafts and/or several cars has either a control unit for controlling all of the cars or several control units for controlling one or more cars each. In one embodiment, the control unit or the control units are then set up to receive control requests for moving one of the cars from at least one terminal, to check a control request for at least one condition and to move the respective car or several respective cars accordingly if the at least one condition of the control request is met. To do this, the control unit generates, for example, control commands for controlling corresponding components of the elevator system in accordance with the control request.

A control request includes in particular a car call from a landing position or to a landing position and also in particular a travel destination request from a person who has boarded the car. A control request therefore always includes a target position to which the car is to be moved from an actual position at the time of the control request, either directly or after further control requests have been processed. The car is either moved to the target position in order to pick up the person or transport goods sending the control request or to transport the person or transport goods sending the control request to a target position.

When a car is controlled, the car is moved from an actual position to the target position, in particular by controlling a drive accordingly. For example, the car remains in a waiting position, for example in one of the landing positions, if there is no control request and is then initially accelerated in the event of a control request from another landing position that is/will be assigned to the car, moved to the target landing position and then braked again there and finally opened. The control unit preferably has a processor, in particular a microprocessor, for receiving, processing and executing control requests, as well as corresponding communication means for communicating with end devices and the car or a drive of the car.

An end device is, for example, a computer, a tablet, a mobile device, in particular a smartphone, or another type of control device. A connection between the control unit and the end device is established, for example, via a local network, such as Bluetooth, WLAN or NFC. Dial-in to such a local network is then made possible in particular for end devices in the vicinity of the elevator system. Alternatively or additionally, a connection is established between the control unit and the end device via the Internet, whereby the control unit has, in particular, a wired Internet connection for this purpose. This advantageously achieves increased user convenience, for example by allowing the elevator car call to be made shortly before entering the building or from a workstation. In addition, it is not necessary for the end device to first establish a connection to a local network.

If the control unit is set up to check a control request for at least one condition, this is, for example, a condition that must be present in the control request itself, in metadata of the control request and/or in a connection with another control request, a state of the elevator system and/or at a point in time or a period of time. In particular, the control unit is set up to check a control request for several conditions. In one embodiment, the control unit is set up to check a control request for one or more conditions dependent on the assigned elevator car and/or the assigned elevator shaft. If the condition or conditions are met, the corresponding control request is executed and the elevator car is controlled accordingly. If the condition or conditions are not met, the control request is generally not executed, for example. However, it can also be provided that the control request is executed despite the condition not being met and, at the same time, other measures such as a check of the relevant terminal or a person using the relevant terminal are initiated. Such a check can then subsequently lead to a blocking of the terminal device or the person using the terminal device in question.

The solution to the problem with the elevator system described above now includes the teaching that by checking conditions, a logical distinction can be made between a legitimate control request, which was sent by an authorized person and is aimed at the actual, proper use of the elevator car, and an unauthorized control request, which is aimed, for example, at the misuse, in particular the blocking or manipulation, of the elevator system. The elevator system thus advantageously ensures that misuse is reliably detected and the corresponding control requests can be excluded from the elevator control system or handled in another way. In particular, a tax request identified as misuse is also registered and can be tracked if necessary. In addition, hacker attacks can also be detected using the elevator system, for example in the event that a large number of abusive control requests are registered in a short period of time or from one and the same end device. The advantages mentioned are achieved in particular without the elevator system also having to include elements that are required elsewhere. This means that no additional construction work is required. Nor is any additional work required for a person using the end device.

In one embodiment, an identification feature of the terminal sending the control request is checked as a condition. For example, an identification file, in particular an identification number or an identification code, is transmitted between the terminal and the control unit with the control request as metadata. In a further embodiment, an identification feature is, for example, an identifier of the terminal, an IP address assigned in the network or a password entered by a person using the terminal. By assigning or restricting identification features only to or to authorized persons, it is ensured that the elevator system is not misused by unauthorized persons.

In a further embodiment, the position of the terminal sending the control request is checked as a condition. In one embodiment, for example, the GPS position of the terminal is checked to ensure that the person using the terminal is in the building of the elevator system. Alternatively or additionally, the position of the terminal within the building is checked, for example by the elevator system and/or the building having several connection points for logging the terminal into the network and checking at which connection point the terminal is dialed into the network. For example, it is recognized that a person is in the area of the elevator system, in a certain landing position or in a certain elevator car. Position data is also already available when the terminal dials into the Internet and, in a further embodiment, is sent along with the control request. The terminal can also send a position file in the metadata of the control request, which is created, for example, on the terminal by input or by a position marker. The elevator system then has corresponding position markers, for example in the area of each landing position or in each elevator car. By checking the position, it is ensured that the person using the device is actually in the area of the elevator system, so that there is a high probability that there is an actual and legitimate intention to use the elevator system. Furthermore, control requests from individual people whose position is away from the elevator system and/or the building can also be permitted, for example if the person is a priority or if the control requests are made during remote maintenance. A matching position can also be used to identify that multiple control requests are being sent from the same device.

In a further embodiment, an actual position of the elevator car and/or a target position for the elevator car is checked as a condition, in particular at the time at which the control request is sent. In this case, misuse can be identified in particular via relevant patterns in the control requests from a specific terminal device. For example, if a control request is always sent from a terminal device when the elevator car is in a specific actual position or if control requests are sent to different target positions, in particular within a short period of time, this can indicate misuse. The control requests are then rejected, for example, in particular in the event of a repeat offense, and/or a check of the terminal device and/or the person using the terminal device is initiated.

In yet another embodiment, a number of preceding control requests in a certain period of time is checked as a condition. Many control requests in a short period of time can be an indication of misuse and in particular of a hacker attack, which are thus detected or excluded. A threshold value above which a control request is no longer permitted due to too many preceding control requests in the period of time is defined, for example, based on the conditions of the elevator system and/or based on a number of control requests per time that is usual for the elevator system. In particular, a number of preceding control requests from the same terminal in the certain period of time are checked, which is a particularly clear sign of misuse. By checking the control requests per period of time, the probability of overloading the elevator system is already reduced. The utilization is made up of the number of existing control requests and the Duration or effort required to execute each individual tax request.

In yet another embodiment, the capacity of the elevator system is checked as a condition. If, for example, there are already a number of control requests that are very complex to execute and/or a large number of control requests that are easy to execute, the condition is not met. A corresponding message about a long waiting time is then sent to the terminal, for example, and the execution of the control request is put on the back burner after the control requests that have already been submitted.

In a preferred embodiment, one condition is to check whether the control request matches control requests that are determined to be usual. Control requests that are determined to be usual are stored in the control unit, for example, or are learned by the control unit through data collection and evaluation for a specific elevator system during its operation. To do this, the control unit uses machine learning methods, such as a neural network. The usualness of control requests lies, for example, in the ratio of the number of control requests in a period of time to the time of day. In an office building, the utilization is particularly high at the beginning and end of a working day, as well as at a usual break time, such as the usual lunch time, but significantly lower in between. Likewise, at the beginning of the day it is usual for the elevator car to be called from a ground floor, and at the end of the day the ground floor is usually the target position of a control request sent from the elevator car. Between the beginning and the end of the day, the target positions to which the elevator car is called and the target positions that are selected from the elevator car are usually distributed more evenly across the building. Any deviation from the above-mentioned patterns indicates potential misuse, so that a corresponding tax request or a terminal device sending the tax request or a person using the terminal device can be checked and/or the tax request can be refused.

In a preferred embodiment, the control unit is set up to send a notification to the terminal and/or another data processing device if the at least one condition is not met, to delete the control request and/or to block the terminal from sending further control requests. The further data processing device is in particular a central building management system or the terminal of a person supervising the elevator system. The measure is also preferably based on other criteria, for example whether a certain terminal has already sent control requests that have been identified as abusive several times, whether the misuse is classified as simple, serious or even dangerous misuse and whether notification of the person using the terminal is desired. Advantageously, a situational and adequate measure can be taken in response to a disruption to the operation of the elevator system caused by the control request that has been identified as abusive, so that, for example, an unjustified exclusion of a terminal is prevented, but at the same time trouble-free operation of the elevator system is ensured.

The control unit preferably has connection means for connecting to the Internet or for connecting to a terminal device via a local network. These are particularly preferably wired means, but they can also be wireless means such as a WLAN or Bluetooth adapter. In one embodiment, the means are also used to communicate with other control units of the elevator system or with control units of other elevator systems in addition to the terminal devices.

The object is further achieved by a method for operating a previously described elevator system, wherein the control unit receives control requests for moving the elevator car from at least one terminal, and wherein a control request is checked for at least one condition and the elevator car is moved between the landing positions if the at least one condition of the control request is met. The method accordingly has the advantages described above with regard to the elevator system. In particular, the method reliably detects the misuse of an elevator system through control requests sent by terminals, so that appropriate measures can be taken.

The object is also achieved by a computer program product comprising commands which, when the control unit executes the method described above, cause the control unit to execute the method. The advantages described above with regard to the method and the elevator system apply accordingly to the computer program product.

The object is also achieved by a computer-readable medium on which the above-described computer program product is stored. The advantages described above with regard to the method, the elevator system and the computer program product apply accordingly to the computer-readable medium.

Short description of the drawings

The invention is explained in more detail below with reference to the accompanying drawings using preferred embodiments. The wording figure is abbreviated to Fig. in the drawings.

• 1 eine schematische und nicht maßstäbliche Darstellung einer Aufzugsanlage nach einem Aspekt der Erfindung sowie damit zusammenwirkender Endgeräte; und
• 2 eine Verfahrensschaubild zur Darstellung eines Verfahrend nach einem weiteren Aspekt der Erfindung.

In the drawings show

• 1 a schematic and not to scale representation of an elevator system according to one aspect of the invention and terminal devices interacting therewith; and
• 2 a process diagram illustrating a method according to a further aspect of the invention.

Detailed description of the drawings

The described embodiments are merely examples that can be modified and/or supplemented in many ways within the scope of the claims. Each feature described for a specific embodiment can be used independently or in combination with other features in any other embodiment. Each feature described for an embodiment of a specific claim category can also be used in a corresponding manner in an embodiment of another claim category.

1 shows an elevator system 1 with a first elevator shaft 2.1 and a second elevator shaft 2.2. It is also possible and also in the sense of the present invention to consider the first elevator shaft 2.1 as a first elevator system 1.1 and the second elevator shaft 2.2 as a second elevator system 1.2.

In the first elevator shaft 2.1, a first car 3.1 can be moved between several landing positions 4.1, 4.2, 4.3, 4.4 formed by floors of a building. The first car 3.1 is held by a support means 5, wherein the support means 5 is driven by a drive 6 arranged in a machine room of the first elevator shaft 2.1 and is also connected to a counterweight 7. The first car 3.1 also has a first car door 8.1, which in the landing positions 4.1, 4.2, 4.3, 4.4 is aligned with landing doors 9.1, 9.2, 9.3, 9.4 of the first elevator shaft 2.1, so that a passage is created between the respective floor and the first car 3.1. In the first elevator shaft 2.1, a first control unit 10.1 is also arranged in the machine room, which is designed to control the drive 6 and thus the first elevator car 3.1. The first control unit 10.1 has first connection means 11.1 for connecting to a network, for example a Bluetooth or WLAN network or the Internet, as indicated by a network symbol.

In the second elevator shaft 2.2, a second car 3.2 and a third car 3.3 can be moved between the landing positions 4.1, 4.2, 4.3, 4.4. The second car 3.2 and the third car 3.3 have secondary parts 12.1, 12.2 of a linear motor, which form the linear motor with a primary part 13 arranged in the second elevator shaft 2.2. The second elevator car 3.2 and the third elevator car 3.3 also have a second elevator car door 8.2 and a third elevator car door 8.3, respectively, which are aligned with landing doors 14.1, 14.2, 14.3, 14.4 of the second elevator shaft 2.2 in the landing positions 4.1, 4.2, 4.3, 4.4, so that a passage is created between the respective floor and the second elevator car 3.2 and the third elevator car 3.3. In the second elevator shaft 2.2, a second control unit 10.2 is also arranged in a machine room, which is designed to control the primary part 13 of the linear motor and thus the second elevator car 3.2 and the third elevator car 3.3. The second control unit 10.2 has second connection means 11.2 for connecting to a network, for example a Bluetooth or WLAN network or the Internet, as indicated by a network symbol.

In the area of the elevator system 1, several terminal devices 15.1, 15.2, 15.3, 15.4, 15.5 are positioned, which are carried by people (not shown) who use the terminal devices 15.1, 15.2, 15.3, 15.4, 15.5, and which are also connected to the network, as indicated by a network symbol. Position markers 16.1, 16.2, 16.3, 16.4 are also arranged on the first elevator shaft 2.1 to provide a position signal in the respective landing positions 4.1, 4.2, 4.3, 4.4. The position markers 16.1, 16.2, 16.3, 16.4 can also be designed as network adapters to provide a local network so that the end devices 15.1, 15.2, 15.3, 15.4, 15.5 can dial into it.

If, for example, the first terminal 15.1 is in the first landing position 4.1 as shown in the area of the first position marker 16.1, it establishes a connection with it and receives position information. This position information is sent along with a control request to call the first elevator car 3.1. When the control request is received, the first control unit 10.1 then checks whether the first terminal 15.1 is in the area of a position marker 16.1, 16.2, 16.3, 16.4 and carries out the control request or a If the test is positive, the control command generated from it is output.

However, if the second terminal 15.2 is too far away from a position marker 16.1, 16.2, 16.3, 16.4 to establish a connection with it, it cannot send the corresponding position information to authenticate the control request with the control request. The second terminal 15.2 is located, for example (but not shown in detail), at a workstation in an office and not in the area of the first elevator shaft 2.1 defined by the position markers 16.1, 16.2, 16.3, 16.4, so that it cannot be assumed that the person using the second terminal 15.2 has arrived at the third landing door 9.3 when the first elevator car 3.1 is called by the time the first elevator car 3.1 reaches the third landing position 4.3. The control request of the second terminal 15.2 is therefore qualified as misuse and rejected. For example, a corresponding notification can then be sent to the person using the second terminal 15.2.

The third terminal 5.3 is located in the area of the fourth position marker 16.4 or the fourth landing position 4.4 and can therefore fulfill the condition of the position information. However, a check of the actual position of the first car 3.1 shows that it is also in the fourth landing position 4.4. If the third terminal 15.3 sends a call to the first car 3.1 as a control request, even though the first car is already in the position of the third terminal 15.3 and the first car door 8.1 is open, a corresponding condition is not fulfilled and the control request is rejected. Likewise, a control request from the fourth terminal 15.4, which is in the first car 3.1, would be rejected if it were aimed at moving the first car 3.1 to the fourth landing position 4.4.

The fifth terminal 15.5 is located in the area of the second elevator shaft 2.2. If a call for a car 3.2, 3.3 is sent from this as a control request, an authorization ID or a password is requested as a condition, for example. The control request is also assigned to the second elevator shaft 2.2, for example by means of position information or a manual selection on the fifth terminal 15.5. The call also requests a target position as a condition. If no target position is transmitted with the control request, it is not possible to select a car from the second car 3.2 and the third car 3.3 to execute the control request and the control request is rejected, for example. If the control request states, for example, that a trip to the first landing position 4.1 is desired, the third elevator car 3.3 must be moved to a waiting position 17 so that the second elevator car 3.2 can reach the fourth landing position 4.4 and the person using the fifth terminal 15.5 can travel to the first landing position 4.1. Other conditions that are not shown in the figures include, for example, the capacity utilization of an elevator system 1, 1.1, 1.2 or the usualness of a control request in comparison with learned patterns.

2 shows a diagram of a method 20 for operating an elevator system 1, 1.1, 1.2 according to one aspect of the invention. In a first step 21, a control unit 10.1, 10.2 receives control requests for moving a car 3.1, 3.2, 3.3 from at least one terminal 15.1, 15.2, 15.3, 15.4, 15.5. For example, such a control request is sent from a smartphone app via a local Bluetooth, WLAN or NFC network or the Internet to the control unit 10.1, 10.2, which is also connected to the local network or the Internet. In a second step 22, the control request is checked for at least one condition. If the control request fulfills at least one condition, the car 3.1, 3.2, 3.3 will move between the landing positions 4.1, 4.2, 4.3, 4.4 in a third step 23 according to the control request.

If the control request does not meet the at least one condition, a notification is sent to the terminal 15.1, 15.2, 15.3, 15.4, 15.5 and/or another data processing device, for example in a fourth step 24. For example, the person using the terminal 15.1, 15.2, 15.3, 15.4, 15.5 is informed that their control request has been identified as abusive or a person supervising the elevator system 1, 1.1, 1.2 is informed of misuse/suspected misuse. Furthermore, for example, if the control request does not meet the at least one condition, the control request is deleted in a fifth step 25. Finally and still for example in a sixth step 26 the terminal 15.1, 15.2, 15.3, 15.4, 15.5 is blocked from sending further control requests. For example, steps 24, 25 and 26 can be carried out only partially or in full, depending on whether the abuse is classified as minor, severe and/or dangerous. For example, steps 24, 25 and 26 can be carried out in stages in the case of multiple abuses. Steps 24, 25 and 26 can also be carried out simultaneously or one after the other.

List of reference symbols

1

Elevator system

1.1

Elevator system

1.2

Elevator system

2.1

first elevator shaft

2.2

second elevator shaft

3.1

first car

3.2

second car

3.3

third car

4.1

first landing position

4.2

second landing position

4.3

third landing position

4.4

fourth landing position

5

Carrying means

6

drive

7

Counterweight

8.1

first car door

8.2

second car door

8.3

third car door

9.1

first landing door of the first elevator shaft

9.2

second landing door of the first elevator shaft

9.3

third landing door of the first elevator shaft

9.4

fourth landing door of the first elevator shaft

10.1

first control unit

10.2

second control unit

11.1

first connecting means

11.2

second connecting means

12.1

first secondary part of the linear motor

12.2

second secondary part of the linear motor

13

Primary part of the linear motor

14.1

first landing door of the second elevator shaft

14.2

second landing door of the second elevator shaft

14.3

third landing door of the second elevator shaft

14.4

fourth landing door of the second elevator shaft

15.1

first device

15.2

second device

15.3

third device

15.4

fourth device

15.5

fifth device

16.1

first position marker

16.2

second position marker

16.3

third position marker

16.4

fourth position marker

17

Waiting position

20

Proceedings

21

First step of the process - receiving tax requests

22

Second step of the procedure - checking the tax request for condition

23

Third step of the procedure - moving the car

24

fourth step of the procedure - sending a notification

25

Fifth step of the procedure - deletion of the tax request

26

Sixth step of the procedure - blocking the terminal

Claims (14)

Elevator system (1, 1.1, 1.2) for transporting people and/or goods, comprising at least one elevator shaft (2.1, 2.2); at least one elevator car (3.1, 3.2, 3.3) that can be moved along the elevator shaft (2.1, 2.2) between several landing positions (4.1, 4.2, 4.3, 4.4); and a control unit (10.1, 10.2) for controlling the elevator car (3.1, 3.2, 3.3); wherein the control unit (10.1, 10.2) is set up to receive control requests for moving the elevator car (3.1, 3.2, 3.3) from at least one terminal (15.1, 15.2, 15.3, 15.4, 15.5) via a network; and wherein the control unit (10.1, 10.2) is configured to check a control request for at least one condition and to move the elevator car (3.1, 3.2, 3.3) between the landing positions (4.1, 4.2, 4.3, 4.4) if the at least one condition of the control request is met. Lift system (1, 1.1, 1.2) according to Claim 1 , whereby as a condition an identification feature of the terminal device (15.1, 15.2, 15.3, 15.4, 15.5) sending the control request is checked. Lift system (1, 1.1, 1.2) according to Claim 1 or 2 , whereby the position of the terminal (15.1, 15.2, 15.3, 15.4, 15.5) sending the control request is checked as a condition. Elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein an actual position of the elevator car (3.1, 3.2, 3.3) and/or a target position for the elevator car (3.1, 3.2, 3.3) is checked as a condition. Elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein a number of preceding control requests in a certain period of time are checked as a condition. Elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein a capacity utilization of the elevator installation (1, 1.1, 1.2) is checked as a condition. Elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein as a condition the agreement of the control request with control requests determined as usual is checked. Elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein the control unit (10.1, 10.2) is configured to send a notification to the terminal (15.1, 15.2, 15.3, 15.4, 15.5) and/or another data processing device if the at least one condition is not met, to delete the control request and/or to block the terminal (15.1, 15.2, 15.3, 15.4, 15.5) from sending further control requests. Elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein the control unit (10.1, 10.2) has connection means (11.1, 11.2) for connecting to the Internet or for locally connecting to a terminal (15.1, 15.2, 15.3, 15.4, 15.5). Lift system (1, 1.1, 1.2) according to Claim 9 , wherein the connecting means (11.1, 11.2) are designed for local connection to a WLAN or Bluetooth network. Method (20) for operating an elevator installation (1, 1.1, 1.2) according to one of the preceding claims, wherein the control unit (10.1, 10.2) receives control requests for moving the elevator car (3.1, 3.2, 3.3) from at least one terminal (15.1, 15.2, 15.3, 15.4, 15.5) (21), and wherein a control request is checked for at least one condition (22) and the elevator car (3.1, 3.2, 3.3) is moved between the landing positions (4.1, 4.2, 4.3, 4.4) in accordance with the control request if the at least one condition is met (23). Procedure (20) according to Claim 11 , wherein if the at least one condition is not met, the control unit (10.1, 10.2) sends a notification to the terminal (15.1, 15.2, 15.3, 15.4, 15.5) and/or a further data processing device (24), the control request is deleted (25) and/or the terminal (15.1, 15.2, 15.3, 15.4, 15.5) is blocked from sending further control requests (26). Computer program product comprising instructions which are used in executing the method (20) according to one of the Claims 11 or 12 by the control unit (10.1, 10.2) cause the control unit (10.1, 10.2) to carry out the method (20). Computer-readable medium on which the computer program product is Claim 13 is stored.

Images