EP2493802A1

EP2493802A1 - Safety circuit in an elevator system

Info

Publication number: EP2493802A1
Application number: EP10771084A
Authority: EP
Inventors: Eric Birrer
Original assignee: Inventio AG
Current assignee: Inventio AG
Priority date: 2009-10-26
Filing date: 2010-10-20
Publication date: 2012-09-05
Anticipated expiration: 2030-10-20
Also published as: RU2543476C2; MY166790A; JP2013508245A; MX2012003015A; AU2010314253A1; EP2493802B1; RU2012121879A; WO2011054674A1; CA2775635C; ES2477564T3; CN102596780B; US20120186914A1; BR112012009140A2; KR101666251B1; MX340867B; AU2010314253B2; HK1171003A1; JP5755233B2; KR20120092116A; NZ599051A

Abstract

The invention relates to a safety circuit (200) in an elevator system (100), comprising at least one series connection (43) of safety-relevant contacts (20a-20d, 26), which are closed during trouble-free operation of the elevator system (100), wherein in the case of certain operating conditions in which at least one contact (20a-20d, 26) is opened, said least one contact (20a-20d, 26) can be bridged by means of semiconductor switches (36a, 36b), and wherein the semiconductor switches (36a, 36b) can be controlled by means of at least one processor (34c, 34d) and monitored by means of at least one monitoring circuit (37a, 37b) for short circuits, and further comprising at least one electromechanical relay circuit (42a), having relay contacts (31c, 31d) connected in series with the contacts (20a-20d, 26) of the bridged series connection (43), wherein the relay circuit (42a) can be controlled by means of the at least one processor (34c, 34d) and the bridgable series connection (43) can be interrupted by means of the relay contacts (31c, 31d) in the case of short-circuiting of the semiconductor switches (36a, 36b).

Description

Safety circuit in an elevator system

The present invention relates to a

Elevator installation, in which at least one elevator car and at least one counterweight are moved in opposite directions in an elevator shaft, wherein the at least one elevator car and the at least one counterweight run along guide rails, carried by one or more support means. The one or more suspension elements are guided over a traction sheave of a drive unit which has a drive brake. Furthermore, the elevator system has a safety circuit which, among other things, activates the drive brake in an emergency and includes a bridging of the door contacts so that the safety circuit remains closed when the doors are opened. The present invention particularly relates to the safety circuit.

In conventional elevator systems reach to

Bridging the door contacts electromechanical switches to use. However, especially in elevator systems in office buildings, the number of trips of the elevator car can be more than 1000 per working day, the bridging of the

Door contacts done twice each time. Thus, the electromechanical switches have a number of approximately 520,000 circuits per year. This number is so high that the electromechanical switches become the main limiting factor for the reliability of the door contacts bridging. Due to the high number of circuits and the high requirements, the bridging of the door contacts is classified as a so-called high-demand safety function.

In general, the IEC 61508 standard defines high-demand safety functions as functions that, on average, switch over more than once a year during trouble-free normal operation of the elevator system, while low-demand safety functions designate such functions as are provided only for emergencies of the elevator system or only for an emergency operation of the elevator system, in which there is a fault and switch on average less frequently than once a year. An essential element of this international standard

IEC 61508 is the determination of the safety integrity level (SIL, there is SIL1 to SIL4). This is a measure of the necessary or achieved risk-reducing effectiveness of the safety functions, with SIL1 having the lowest requirements. As essential parameters for the

Reliability of the safety function of equipment or installations is provided by the calculation basis for PFH (Probable Failure Per Hour) and PFD (Probability of Failure on Demand). The first parameter PFH refers to high-demand systems, ie those with a high demand rate, and the second parameter PFD to low-demand systems, the time of their

Operating time as good as not be operated. From these parameters, the SIL can be read off.

[005] Another, in specialized media, based on this standard

(IEC 61508-4, section 3.5.12) findable definition of the low-demand mode and the high-demand mode (high-demand mode or continuous mode) specifies their distinction not only on the basis of low or high (continuous) request rate, but

as follows: A (low-demand) safety function operating in the request mode is executed only on request and brings the system to be monitored into a defined safe state. The executing elements of this low-demand security feature have no effect on this

monitoring system before making a request to the

Safety function occurs. One (high-demand)

On the other hand, the safety function, which operates in continuous mode, always keeps the system to be monitored in its normal safe state. The elements of this high-demand Safety function constantly monitor the system to be monitored. A failure of the elements of this (high-demand)

Safety function leads directly to a hazard, if no other safety-related systems or external

Measures to reduce risk. Furthermore, there is a low-demand safety function when the

Requirement rate is not more than once a year and is not greater than twice the frequency of the re-examination. A high-demand safety feature or continuous safety function, however, exists when the

Requirement rate is more than once a year or greater than twice the frequency of the retesting test (see also IEC 61508-4, section 3.5.12). The object of the present invention is a

To propose a safety circuit for a lift installation, the more reliable and secure fulfillment of a frequently switching high-demand safety function such as

Bridging the door contacts and thus increases the security, but also the cost-efficiency and low maintenance of the entire elevator system.

The solution of the problem is first in the targeted replacement by electronic semiconductor switches that conventional electromechanical switch, which are claimed by a large number of circuits (high-demand safety function). Such a high-demand safety function is, for example, the bridging of the door contacts, but there are also other, connected in trouble-free normal operation security features into consideration, especially those that are frequently switched.

[008] Such semiconductor switches, for example with metal

Oxide Semiconductor Field Effect Transistors MOSFET (Metal Oxide Semiconductor Field-Effect Transistor), are generally based on transistors that make millions of switching cycles per day

withstand. The disadvantage is only their tendency in case of failure to cause a short circuit that is a permanent one

Bridging all door contacts would result. In other words, if for redundancy, preferably two

Semiconductor switches (to meet safety level SIL2) are provided for the bridging of the door contacts, and these two semiconductor switches should fail because of a short circuit, the high risk situation occurs that the

Elevator car and the counterweight with open manhole and / or cabin doors can be moved because of

Semiconductor short circuit simulates closed doors.

In general, to avoid or detect a short circuit in a semiconductor switch usually complicated and costly solutions for the so-called failsafe proposed.

Publication EP-A2-1 535 876

discloses a drive, which is connected to a power semiconductor having electronic device, wherein between the drive and the electronic device at least one

Main contactor is provided, which is connected to a safety circuit comprising series-connected door switch. These serially connected door switches are in turn bridged with switches when opening the doors. These

Publication thus discloses the use of semiconductors - power semiconductors in an electronic device of the drive, but not within the safety circuit, as well as no failsafe solution to avoid the short circuit tendency of the semiconductors, but rather serving a noise avoidance Anbieiben the at least one main contactor and a Verification of the latter by a timer and / or a counter.

In a safety circuit according to the present

According to the invention, no separate fail-safe solution is provided for the respective electronic semiconductor switches, but an otherwise existing one, otherwise Electromechanical safety relay is involved in the prevention or detection of a possible short circuit in one of the electronic semiconductor switch. This means according to the invention that, in the event of a short circuit in one of the electronic semiconductor switches, which according to the invention and for reasons of redundancy (safety level SIL2) are provided twice for bridging the door contacts, nothing happens yet. However, if the second electronic solid-state switch breaks down as well - which can be done more quickly due to possible overload peaks - there is no dedicated failsafe solution or no extra safety relay provided for this purpose

But at least one existing electro-mechanical safety relay, which would open the safety circuit in the context of another safety function, if an irregularity would exist within this latter safety function. Alternatively, the opening of the safety circuit can take place even in the event of the failure of the first semiconductor switch.

[0012] This - at least one - other,

electromechanical safety relays of the first

safety-relevant function of the elevator installation is

preferably provided for a so-called low-demand security function, i. for a safety function, which is subject to a few switching processes, for example, switching only in emergencies outside of normal operation. (Please refer

Definition of Low and High Demand modes in paragraphs [003] - [005]).

[0013] According to the invention, such another

For example, a safety relay may be a so-called ETSL relay circuit, ETSL being for Emergency Terminal Speed

Limiting stands, ie for a speed-dependent emergency shaft end delay control. Such ETSL relay circuits are known from the prior art. This ETSL relay circuit is a so-called low-demand safety component used in the Normal operation is not needed. It occurs only very rarely in function, namely only if the elevator car should go beyond its normal range. This ETSL relay circuit is electromechanical, ie it has none

Semiconductor, but relay contacts and electromechanical

Safety relay on and is inventively involved in addition to its ancestral shaft end delay control function in the monitoring of the semiconductor switch. These

Semiconductor switches are used according to the invention for a high-demand safety function, for example for the

Bridging of the door contacts, but generally speaking for a series connection of contacts, with trouble-free

Normal operation are closed, at certain

Operating conditions, however, are opened and then bridged, so that the entire safety circuit remains active.

With other words, the elements of the

Electromechanical relay circuit - or at least parts thereof - according to the invention used in the case of a short circuit of one or both semiconductor switches to open the safety circuit.

The monitoring of the semiconductor switch is carried out according to the invention by means of a monitoring circuit which is processor-controlled. If the monitoring shows that the semiconductor switches are short-circuited, the processor (s) according to the invention are capable of, preferably via an otherwise, anyway existing electromechanical relay circuit - for example, an ETSL relay circuit - the

To open the safety circuit of the lift system.

In a first solution is provided that

at least one processor is capable of doing the

Semiconductor switch (for example, to bridge the

Door contacts) while monitoring the

To control semiconductor switch. On the other hand, the at least one processor according to the invention is capable of simultaneously a detected due to the monitoring short circuit directly to this in turn connected in series relay contacts or directly to one or more electromechanical

Safety relay of otherwise electromechanical

Controlling relay circuit. In other words, it is inventively preferred that the other relay circuit itself no longer own any processor and the above-mentioned at least one processor controls both the semiconductor switches, as well as their monitoring, as well as the traditional function of the electromechanical relay circuit.

That is, in the example case that the

electromechanical relay circuit the ETSL function of

Elevator system, it means that the ETSL function has no or no own processors. The at least one processor for the semiconductor switches and their monitoring also takes over the ETSL function. This only requires appropriate lines and the corresponding

Circuit with the now both safety-relevant functions exporting processor and gives a considerable

Cost advantage.

However, as a further alternative, it is also possible to continue to use the or the controlling processors of the electromechanical relay circuit and the one or more controlling processors of the semiconductor switches for opening the

Safety circuit because of a short circuit of the

Semiconductor switch to the or the controlling processors of the electromechanical relay circuit forward.

Furthermore, it would also be possible to continue to use the or the controlling processors of the electromechanical relay circuit, but the control command of

Processors for the semiconductor switches to open the

Do not forward safety circuit to the or the controlling processors of the electromechanical relay circuit, but the processors of the semiconductor switches directly to the

Relay contacts or access to associated electromechanical safety relays.

As already mentioned, the bridging of the

Series connection of contacts often be a switching high-demand function, for example, the bridging of the door contacts, which takes place according to the invention with semiconductor switches. Despite this use of semiconductor switches, however, the same level of safety as with electromechanical

Safety relay achieved by in case of failure

(Short circuit) of bridging the door contacts, preferably the ETSL safety relay (s) are used to reopen the safety circuit and avoid dangerous situations.

At least the same or a raised

To achieve security level, it is basically

required, only such electromechanical safety relays in the inventive integration for the circumvention of a short circuit out of service bridging the

To consider door contacts by means of semiconductor switches, with regard to their circuits, their design and their safety level (so-called SIL level, where SIL stands for Safety Integrity Level, see paragraph [004]) for a

machine operation non-bridgeable safety function are provided. That is, the electromechanical

Safety Relay must at least be designed so that it covers a safety function that is so essential element that it is intentionally bridged only during manual operation or even bridged.

As already mentioned, the two conventional electromechanical relays for bridging the door contacts according to the invention, for example, replaced by two MOSFET.

Furthermore, according to the invention, the two MOSFETs are each provided with a processor or microprocessor and a monitoring device. Circuit or test circuit by taking a voltage measurement at one input and one output of the MOSFET, separately for each channel. If one or both of the MOSFETs should be defective (which in most cases means short circuits for such switches), the respective processor will detect this condition and open the ETSL relay contact (s). Another advantage is thus that even both MOSFETs can be defective at the same time; that way the

Device or the elevator system but still safe.

Furthermore according to the invention is an indication

provided that provides information if a short circuit in one of the semiconductor switches by one of

electromechanical safety relay or its contacts is bypassed.

The MOSFETs are normally always closed when the doors are open. Consequently, it is provided that the respective processor opens the MOSFET briefly at a regular interval of a few seconds in order to check the voltage drop across the MOSFET without the safety relay of the MOSFET

Safety circuit drops and thus the corresponding

Relay contact of the safety circuit opens. These

Off period is according to the invention short enough to the

To measure voltage drop, but not so long to drop the relay de safety circuit.

A person skilled in the art remains free who has just described

Check not by means of the measurement of the voltage drop, but to realize by means of a measurement of the current, preferably inductive and non-contact.

The present invention thus presents a

Hybrid solution that has the proven safety of

electromechanical relays with high reliability - especially with regard to the number of switching cycles - of Transistors combined in a cost effective manner

A bridging circuit according to the invention thus preferably comprises semiconductor switches for frequently switching high-demand safety functions - such as

for example, the bridging of the door contacts - and a processor-controlled test circuit for this

Semiconductor switches, and preferably the integration of an electromechanical safety relay, normally responsible for another, rarely switching, low-demand

Safety function, to bypass the semiconductor switches in case of a semiconductor short circuit and opening of the

Safety circuit. In addition, the safety circuit includes the usual features and switching arrangements, as they correspond to today's elevator systems - not least because of the applicable standards - and a person skilled in the art

Elevator installation are common. Such features are

For example, the serial arrangement of all shaft door contacts, the also serial arrangement of the car door contacts or the monitoring of the path of the elevator car with limit switches (KNE - contact emergency end), monitoring the speed of movement of the elevator car with sensors at the end of the shaft (ETSL), Brake contacts, as well as at least one

Emergency switch .

Further or advantageous embodiments of an inventive safety circuit form the objects de dependent claims.

Based on figures, the invention is explained symbolically and by way of example closer. The figures are related and described comprehensively. The same reference symbols denote the same components, reference symbols with different indices indicate functionally identical or similar components. Thereby show

Fig. 1 is a schematic representation of an exemplary

Aufzugsanläge;

Fig. La is a schematic representation of the safety circuit of FIGS. 1 and

Fig. 2 is a schematic representation of a

inventive arrangement of two semiconductor switches for bridging a series connection of contacts, one

Monitoring circuit for these two semiconductor switches, an electromechanical relay circuit and the

Integration of this arrangement according to the invention into a conventional safety circuit according to FIG. 1 or FIG. 1a and the safety circuit according to the invention thus obtained. 1 shows an elevator installation 100,

for example in illustrated 2: 1 support means guide. In an elevator shaft 1, an elevator car 2 is movably arranged, which is connected via a support means 3 with a movable counterweight 4. The support means 3 is driven during operation by means of a traction sheave 5 of a drive unit 6, which are arranged for example in the uppermost region of the elevator shaft 1 in a machine room 12. The elevator car 2 and the counterweight 4 are guided by means of guide rails 7a, 7b and 7c extending over the shaft height.

The elevator car 2 can at a head h h a top floor with floor door 8, more floors with floor doors 9 and 10 and a lowest floor with

Maintain floor door 11. The elevator shaft 1 is made of shaft side walls 15a and 15b, a shaft ceiling 13 and a

Manhole bottom 14 is formed, on which a shaft bottom buffer 19a for the counterweight 4 and two shaft bottom buffers 19b and 19c for the elevator car 2 are arranged. The support means 3 is fixed to a

Fixing point or Tragmittelfixpunkt 16a at the

Shaft cover 13 attached and parallel to the shaft side wall 15a led to a support roller 17 for the counterweight 4. From here, in turn, back via the traction sheave 5, to a first deflection or support roller 18a and a second deflection or

Carrying roller 18b, the elevator car 2 unterschlingend, and to a second stationary attachment point or Tragmittelfixpunkt 16b on the shaft ceiling 13th

A safety circuit 200 includes on each of

Floors 8-11 are each a bay door contact 20a-20d, which are arranged in series in a shaft door circuit 21. Of the

Shaft door circuit 21 is fed to a PCB (Printed Circuit Board) 22, which is arranged, for example, in the machine room 12. The PCB 22 is connected to an only symbolic connection 23 to the drive 6 or a

Drive brake 24 connected so that error messages of the

Safety circuit 200, the drive of the drive unit 6 and the rotation of the traction sheave 5 can be stopped.

The connection 23 is to be understood only symbolically, because in reality it is much more complicated and usually includes the elevator control. It also has a relay 40 of the safety circuit 200 and connection points 41a and 41b. Between the latter, a dual-channel end-of-stroke delay control function 42 is typically implemented to satisfy the SIL2 security level, in which a first ETSL channel and a second ETSL channel are connected in series in the

Safety circuit 200 are arranged. The two ETSL channels are shown symbolically as switches 31a and 31b, but are switching relays with switching contacts.

[0037] Not only the shaft doors have a shaft door

The hoistway door opening control circuit 21 also has the elevator car 2 having a car door control circuit 25 for opening the opening of two

indicated cabin sliding doors 27a and 27b. This

Cabin door circuit 25 includes a car door contact 26. Signals from car door circuit 25 are input through Hang cable 28 of the elevator car 2 passed to the PCB 22, where they in series with the shaft door contacts 20a-20d in the

Security circuit 200 are involved. The elevator installation 100 furthermore has a

Bridging circuit 29 for arranged in a series circuit 43 shaft door contacts 20a-20d and also serially arranged cabin door contact 26. Die

Bridging circuit 29 includes between two others

Connecting points 41c and 41d arranged in parallel

Switching relay whose switching contacts are symbolically represented as switches 30a and 30b.

In Fig. La the safety circuit 200 of the elevator installation 100 is shown separately from FIG. 1, so that its connections and circuits are clearer. The end-of-shaft delay control circuit 42 and the door contact bypass circuit 29 are independent of each other, they are only serially integrated into the safety circuit 200.

FIG. 2 shows how, on the one hand, between the connection points 41c and 41d of the

1 circuit circuit according to the invention a bridging circuit 29a for bridging the contacts 20a-20d and 26 of FIG. 1 or la is configured, and how

on the other hand, an electromechanical relay circuit 42a is arranged according to the invention between the connection points 41a and 41b of the safety circuit 200 from FIG. 1; as the

Bridging circuit 29a and the electromechanical

Relay 42a according to the invention are interconnected and thus provide a safety circuit 200 according to the invention and an elevator system 100 according to the invention. Of the

Electromechanical relay circuit 42a preferably represents a relay circuit for performing a low-demand safety function of the elevator installation 100. [0041] For the assumption of a high-demand

Safety function such as the override function of the door contacts is in a first circuit 300a on

Microprocessor 34c connected to a semiconductor switch or transistor 36a accordingly. The transistor 36a is exemplified as a MOSFET transistor, but other types of transistors are also suitable.

Furthermore, a monitoring circuit 37a is indicated, which is applied to an input 38a and an output 39a of the semiconductor switch 36a. The processor 34c controls the periodic cycles of the measurement of the voltage or

Amperage at the input 38a and the output 39a.

Of course, the connection point 38a may also be the

Output of the semiconductor switch 36a and the connection point 39a represent the input of the semiconductor switch 36a.

The bypass circuit 29a, which, as shown in FIG.

1 and la visible, all door contacts 20a-20d, 26 are supplied serially via the connection points 41c and 41d, is designed for redundancy reasons or for the fulfillment of the SIL2 security level two channels. The second channel comprises analogous to the first channel a circuit 300b, a semiconductor switch 36b, a monitoring circuit 37b for the semiconductor switch 36b, which is applied to an input 38b and an output 39b of the semiconductor switch 36b and is controlled by a microprocessor 34d. The microprocessors 34c and 34d are for bidirectional signal exchange

connected with each other. It can also be provided more than two channels.

The microprocessor 34c is further provided with an electromechanical relay 35c, a changeover contact 32c and a resistor 33c of a first ETSL channel

Omitting any ETSL processor from this

remaining elements of an electromechanical relay circuit 42a. The microprocessor 34d is in turn with a electromechanical relay 35d, a changeover contact 32d and a resistor 33d of a second ETSL channel. These two ETSL channels ensure the shaft end delay control function, which is thus accomplished at SIL2 safety level, with the necessary

Delay control circuit 42 between the connection points 41a and 41b of the safety circuit 200 of FIG. 1

connected. The used for the tick according to the invention

Shaft end delay control circuit 42 does not have its own microprocessors because the control of

Delay control circuit 42 is performed by means of the microprocessors 34c and 34d, in addition to the control of

Bridging circuit 29a and in addition to the control of

Monitoring circuits 37a and 37b.

Optionally, an arrangement with a single

Microprocessor possible, which controls both the two illustrated channels of the bypass circuit 29a, and the two illustrated channels of the electromechanical relay circuit 42a and the delay control circuit 42.

Fig. 2 shows schematically an exemplary arrangement of a parallel, two-channel

Bridging of series-connected door contacts (both the shaft door 20a-20d, as well as the car door contact 26) of the elevator system 100a, or in general a possible

inventive combined perception of a first safety-relevant function, preferably a low-demand safety function (for example, the end-of-shaft delay control ETSL) and a second

safety-relevant function, preferably a high-demand safety function (for example, the bridging of the

Door contacts). In a review of the semiconductor switches 36a and

36b by means of the monitoring circuits 37a and 37b, which results in a defect or a short circuit of one of the semiconductor switches 36a or 36b or both semiconductor switches 36a and 36b, the microprocessors 34c and / or 34d according to the invention in a position to the conventional electromechanical safety relays 35c and 35d of the electromechanical relay circuit 42a to

Opening of the safety circuit 200 to control. This takes place in addition to the originally intended shaft end delay of the elevator car 2, the electromechanical

Relay 42a originally could exercise. This originally intended safety function occurs because of

assumed opening function of the safety circuit 200 not out of force, preferably because the microprocessors 34c and 34d both the shaft end delay control circuit of the elevator car 2 of the elevator installation 100, as well as the

Bridging circuit 29a with the semiconductor switches 36a and 36b, as well as the monitoring of the semiconductor switches 36a and 36b control.

The equipped with semiconductor switches 36a and 36b

Bridging circuit 29a is not only suitable for often switching high-demand functions, but also for any low-demand functions, such as the KNE function, where KNE for contact emergency end, so for a travel limit of the elevator car 2 by means of limit switches on their normal way out stands. The bridging circuit 29a, which according to the invention can be combined with an electromechanical relay circuit 42a as disclosed, is also used for example for the braking function or for the emergency evacuation.

Claims

claims

1. safety circuit (200) in an elevator installation (100), with at least one series circuit (43) of safety-relevant contacts (20a-20d, 26) which are closed during fault-free operation of the elevator installation (100), at least one contact (20a-20d, 26) can be bridged by means of semiconductor switches (36a, 36b) under certain operating conditions in which this at least one contact (20a-20d, 26) is opened, and wherein the semiconductor switches (36a, 36b) are connected by means of at least one

Processor (34c, 34d) controllable and by means of at least one monitoring circuit (37a, 37b) to short circuit

can be monitored and with at least one electromechanical relay circuit (42a), connected in series with the contacts (20a-20d, 26) of the bridgeable series circuit (43)

Relay contacts (31c, 31d), wherein the relay circuit (42a) by means of the at least one processor (34c, 34d) is controllable and the bridgeable series circuit (43) in the event of a short circuit of the

Semiconductor switch (36a, 36b) by means of the relay contacts (31c, 31d) can be interrupted.

2. safety circuit (200) according to claim 1, characterized

characterized in that the at least one processor (34c, 34d) in addition to the control and monitoring of the semiconductor switches (36a, 36b) and the relay circuit (42a) is also provided for the control of a further safety-relevant control circuit (42) by means of the relay circuit (42a ) interrupts the series circuit (43).

3. Safety circuit (200) according to one of the preceding

Claims, characterized in that the semiconductor switches (36a, 36b) are metal oxide semiconductor field effect transistors.

4. Safety circuit (200) according to one of the preceding

Claims, characterized in that in the monitoring circuit (37a, 37b) the voltage at an input (38a, 38b) and an output (39a, 39b) of the semiconductor switches (36a, 36b) is measurable.

5. Safety circuit (200) according to one of the preceding

Claims 1-3, characterized in that in the monitoring circuit (37a, 37b), the current at the input (38a, 38b) and the output (39a, 39b) of the semiconductor switches (36a, 36b) is measurable.

6. Safety circuit (200) according to one of the preceding

Claims, characterized in that in the elevator system

(100) an indication of bypassing a short circuit in one of the semiconductor switches (36a, 36b) via one of the relay contacts

(31c, 31d).

7. elevator installation (100) with at least one safety circuit (200) according to one of the preceding claims 1-6.

8. A method for monitoring semiconductor switches (36a, 36b) of an elevator installation (100) according to claim 7, with the following

Steps:

a) periodically measuring the voltage or the current at the input (38a, 38b) and at the output (39a, 39b) of the

Semiconductor switches (36a, 36b);

b) opening the series circuit (43) of the safety circuit (200) by means of at least one relay contact (31c, 31d), if the measurement under step a) resulted in a short circuit.

9. Use of semiconductor switches (36a, 36b) for

Bridging of safety-relevant contacts (20a-20d, 26) of a series circuit (43) of the elevator installation (100), wherein in the event of a short circuit, the semiconductor switch (36a, 36b) the

bridgeable series circuit (43) by means of a

electromechanical relay circuit (42 a) with relay contacts (31 c, 31 d) can be interrupted.

10. Use according to claim 9, characterized in that

Relay circuit (42a) together with the short circuit of the

Semiconductor switch (36a, 36b) for another

Control circuit (42) can be used and in unauthorized operating conditions of the elevator installation (1) the bridgeable series circuit (43) by means of the relay contacts (31c, 31d) of the relay circuit (42a) can be interrupted.