An elevator system includes an elevator car, an elevator controller, and a safety controller, connected to a plurality of safety devices arranged to monitor the elevator system. The safety controller is configured to receive a signal in response to a change of state of any of the safety devices, and to determine a condition of the elevator system in response to the change of state of one or more of the safety devices. If the safety controller renders a determination that the elevator system is in a first condition, the safety controller causes an elevator brake to be deployed, preventing movement of the elevator car. If the safety controller renders a determination that the elevator system is in a second condition, the safety controller allows movement of the elevator car for a predetermined duration or until the elevator car has travelled a predetermined distance.