Monitoring unit for an elevator system, and method

Abstract

A monitoring unit, for monitoring an elevator system, includes a circuit assembly having a power supply unit for dispensing a grid-dependent first operating voltage and at least one processor-controlled monitoring module to actively and/or passively ascertain state data of the elevator system. An energy storage unit, that dispenses a grid-independent second operating voltage, and a first switching device supply the first operating voltage to the monitoring module during a normal operation and supply the second operating voltage to the monitoring module in the event of a power outage. A non-volatile data storage unit that stores a variable operating parameter and a second switching device deactivate parts of the circuit assembly. The monitoring module actuates the second switching device based on the stored operating parameter that has a first value before the monitoring unit is started and has a second value after the monitoring unit is started.

Claims

1. A monitoring unit for monitoring an elevator system, the elevator system including a drive unit moving an elevator car in an elevator shaft, the monitoring unit having a circuit assembly comprising: a power supply unit for dispensing a grid-dependent first operating voltage; at least one processor-controlled monitoring module that at least one of actively and passively ascertains state data of the elevator system; an energy storage unit for dispensing a grid-independent second operating voltage; a first switching device for supplying the first operating voltage to the at least one monitoring module during a normal operation of the elevator system and supplying the second operating voltage to the at least one monitoring module in response to a power outage of the elevator system; a non-volatile data storage unit storing a variable operating parameter; and a second switching device for deactivating parts of the circuit assembly, wherein the at least one monitoring module actuates the second switching device based on the stored operating parameter, the stored operating parameter having a value being a first value before the monitoring unit is started up and a second value after the monitoring unit is started up.

2. The monitoring unit according to claim 1 wherein the at least one monitoring module is a microcontroller that includes at least one processor unit, a volatile main memory, the non-volatile data storage unit and interface units connected together.

3. The monitoring unit according to claim 1 including an operating program stored in the at least one monitoring module and run to read out the value of the operating parameter periodically and wherein the second switching device is actuated based on the value of the operating parameter.

4. The monitoring unit according to claim 1 wherein the first value of the operating parameter is an initialization value implanted in the monitoring unit during production of the monitoring unit, and the second value of the operating parameter is a network address that is associated with the monitoring unit.

5. The monitoring unit according to claim 1 wherein the second switching device is integrated in the at least one monitoring module or is contained discretely in the circuit assembly.

6. The monitoring unit according to claim 1 wherein the second switching device includes at least one switching transistor controlled by the at least one monitoring module.

7. The monitoring unit according to claim 1 wherein when the first value of the operating parameter is present, the second switching device is open and disconnects the energy storage unit from the circuit assembly, and wherein the second switching device is closed when the second value of the operating parameter is present and connects the energy storage unit to the circuit assembly.

8. The monitoring unit according to claim 1 wherein the monitoring unit is connected to a monitoring sensor for detecting changes in a state of the elevator system including whether an elevator door is at least one of unlocked and opened.

9. A method for operating a monitoring unit used to monitor an elevator system, the elevator system including a drive unit moving an elevator car in an elevator shaft, the monitoring unit having a circuit assembly including a power supply unit for dispensing a grid-dependent first operating voltage and at least one processor-controlled monitoring module that at least one of actively and passively ascertains state data of the elevator system, comprising the steps of: providing an energy storage unit dispensing a grid-independent second operating voltage, and a first switching device for supplying the first operating voltage to the at least one monitoring module during a normal operation of the elevator system and supplying the second operating voltage to the at least one monitoring module in response to a power outage of the elevator system; providing a non-volatile data storage unit and storing in the data storage unit a variable operating parameter; providing a second switching device for deactivating parts of the circuit assembly; setting the operating parameter to a first value before the monitoring unit is started up and setting the operating parameter to a second value after the monitoring unit has been started up; and wherein the at least one monitoring module actuates the second switching device based on the stored operating parameter.

10. The method according to claim 9 wherein the at least one monitoring module is a microcontroller that includes at least one processor unit, a volatile main memory, the data storage unit and interface units connected together; and including the steps of storing an operating program in the main memory, running the operating program to read out a value of the operating parameter periodically, and actuating the second switching device based on the read-out value of the operating parameter.

11. The method according to claim 10 wherein when the first value of the operating parameter is present and the first operating voltage is deactivated, the monitoring unit is transferred into a deep sleep mode whereby at least parts of the circuit assembly are disconnected from the energy storage unit, and when the second value of the operating parameter is present and the first operating voltage is deactivated, the monitoring unit is transferred into a battery mode by connecting the second operating voltage from the energy storage unit to the circuit assembly.

12. The method according to claim 11 wherein the first value of the operating parameter is an initialization value that is implanted in the monitoring unit during production or during removal from the elevator system, and wherein the second value of the operating parameter is a network address that is associated with the monitoring unit and is implanted in the monitoring unit after installation in the elevator system by an associated computer.

13. The method according to claim 11 characterized wherein the at least one monitoring module includes at least one timer that repeatedly puts the monitoring unit into a sleep mode when the monitoring unit is in the deep sleep mode and the battery mode and after a predetermined period transfers the monitoring unit into a complete or partial operating state to carry out control measures, and the at least one timer transitions the monitoring unit from the deep sleep mode into a report mode to deliver status reports.

14. The method according to claim 9 wherein the second switching device is arranged inside the at least one monitoring module and deactivates at least part of an electric circuit inside the at least one monitoring module when the first value of the operating parameter and the second operating voltage are present.

15. The method according to claim 9 including connecting the monitoring unit to a monitoring sensor that detects changes in a state of the elevator system, including at least one of an elevator door being unlocked or opened, during the normal operation and during the power outage of the elevator system.

Description

DESCRIPTION OF THE DRAWINGS

(1) The device according to the invention is described by way of example in the following in preferred embodiments with reference to the drawings, in which:

(2) FIG. 1 shows an elevator system 3 comprising a drive unit 38, by means of which an elevator cab 36 arranged in an elevator shaft 35 can be moved between two elevator doors 30A, 30B, and comprising a control device 100 that has a safety unit 1 for monitoring the elevator system 3, which safety unit is connected to monitoring units 10A, 10B according to the invention, by means of which monitoring units a locking mechanism 31A, 31B of an associated elevator door 30A, 30B respectively is monitored and which units can adopt a specific operating mode M1, M2 or M3 according to FIG. 2a or 2b, on the basis of an operating parameter ID0, ID1, ID2;

(3) FIG. 2a shows the first monitoring unit 10A from FIG. 1, which switches between two operating states M1 and M3, shown symbolically, on the basis of the set operating parameter ID0 and the presence of a grid-dependent first operating voltage;

(4) FIG. 2b shows the first monitoring unit 10A from FIG. 1, which can switch between two operating states M1 and M2, shown symbolically, on the basis of the set operating parameter ID1 and the presence of a grid-dependent first operating voltage;

(5) FIG. 3a shows the first monitoring unit 10A from FIG. 1, which only comprises one process-controlled monitoring module 15 that transmits a monitoring signal s.sub.TX from an output port op to an input port ip of the monitoring module 15 via a switching contact 11A that is associated with the door lock 31A of the first elevator door 30A;

(6) FIG. 3b shows the monitoring signal s.sub.TX1 emitted at the output port op by way of example as a pulse sequence having a selected pulse duty cycle of 50%;

(7) FIG. 3c shows the monitoring signal s.sub.TX2 emitted at the output port op by way of example as a pulse sequence having a pulse duty cycle of approximately 7% and a cycle duration T increased by a factor of 7;

(8) FIG. 4a shows the first monitoring unit from FIG. 1 in a further preferred embodiment, comprising the first monitoring module 15, which transmits a monitoring signal s.sub.TX from an output port op to an input port ip of a second process-controlled monitoring module 16 via a switching contact 11A;

(9) FIG. 4b shows the monitoring signal s.sub.TX from FIG. 3b by way of example as a pulse sequence having a pulse duty cycle of 50% before transmission via the switching contact 11A; and

(10) FIG. 4c shows the monitoring signal s.sub.RX from FIG. 3b after transmission via the switching contact 11A, which opened during the duration of two pulses that were not recorded in the register 161 of the second monitoring module 16.

DETAILED DESCRIPTION

(11) FIG. 1 shows an elevator system 3 comprising a drive unit 38, by means of which an elevator car 36 arranged in an elevator shaft 35 can be moved between two elevator doors 30A, 30B. The elevator system 3, which is powered by a central power supply unit 2, is equipped with a control device 100, by means of which the elevator system 3, in particular the drive unit 38, can be controlled. The control device 100 comprises a safeguard unit 1 for monitoring the elevator system 3, which unit is connected or can be connected to monitoring units 10A, 10B, by means of which a lock 31A, 31B of an associated elevator door 30A, 30B respectively, or a monitoring sensor 11A or 11B coupled thereto, can be monitored. The monitoring units 10A, 10B are, e.g., populated circuit boards.

(12) In the present embodiment, the safeguard unit 1 is a stand-alone computer system that communicates with a system computer 1000. However, the safeguard unit 1 may also be integrated in the system computer 1000 as a software module or hardware module. The safeguard unit 1 can, as shown in FIG. 1, intervene directly in the elevator system 3 and, for example, control or turn off the power supply 2 or the drive unit 38. Alternatively, the safeguard unit 1 may be connected only to the system computer 1000, which in turn carries out the safeguarded control of the elevator system 3 by taking into account state data that has been determined on the basis of the monitoring units 10A, 10B.

(13) The safeguard unit 1 and/or the system computer 1000 may also be connected to external computer units, e.g., a host computer, wirelessly or via a wired connection.

(14) In the present embodiment, the monitoring sensors 11A, 11B are formed as switching contacts that are each mechanically coupled to a door lock 31A, 31B that can be actuated by maintenance personnel by means of a tool, as shown in FIG. 1 for the switching contact 11B. During a power outage or deactivation of the power supply, the maintenance personnel can thus actuate a door lock 31A, 31B, manually open an elevator door 30A, 30B and enter the elevator shaft 35.

(15) FIG. 1 shows that after a power outage or deactivation, the lower elevator door 31B has been opened and a maintenance technician has entered the elevator shaft 35 in order to check an electrical installation 8 that, for example, could have caused the power failure. The maintenance technician stands on the shaft floor in a shaft pit that has only a shallow depth. In this situation, the elevator system 3 must not be operated. In the upper level, a building resident moves towards the first elevator door 30A, behind which is the elevator car 36. If the elevator system 3 is supplied with power again in this moment and is put into normal operation, the building resident can enter the elevator car 36 and put it into motion. This is prevented by the switching contacts 11A, 11B being monitored and transition into normal operation being prevented if one of the switching contacts 11A, 11B has been actuated. So that this monitoring can be carried out even after a power outage, the monitoring units 10A, 10B are equipped with an energy storage unit 14 and can be switched into autonomous operation if the elevator system 3 has been completely or partially shut down or if there is a power outage.

(16) FIG. 1 further shows that the two identically formed monitoring units 10A, 10B each comprise a local power supply unit 12 and an energy storage unit 14, both of which can be connected to a first and optionally a second monitoring module 15, 16 via a controllable switch unit 13, e.g., a voltage-controlled relay. Either the power supply unit 12 is connected to the at least one monitoring module 15 via the contacts 132, 133 of the switch unit 13 or the energy storage unit 14 is connected to the at least one monitoring module 15 via the contacts 131, 133 of the switch unit 13. The at least one monitoring module 15 is therefore supplied either with a grid-dependent first operating voltage from the power supply unit 12 or with a grid-independent second operating voltage from the energy storage unit 14.

(17) The switch unit 13 is supplied with a switching voltage us by the power supply unit 12, by means of which switching voltage the switch unit 13 is activated and the power supply unit 12 is connected to the monitoring modules 15, 16 as soon as the first operating voltage is present. If there is a power outage, the switching voltage us is dispensed with and the switch unit 13 returns into the rest position, in which the energy storage unit 14 is connected to the monitoring modules 15, 16 if the switch 19 shown is closed. Due to the identical configuration of the monitoring units 10A, 10B, reference is made in the following only to the first monitoring unit 10A, which comprises at least the process-controlled first monitoring module 15.

(18) In the rest position of the switch unit 13, the energy storage unit 14, which is connected on one side to ground, remains constantly connected to the circuit assembly of the monitoring unit 10A when the switch 19 is closed. If the monitoring unit 10A is removed from the elevator system 3 in this state, the energy storage unit 14 would remain permanently connected to the relevant circuit assembly. Said energy storage unit would also remain permanently connected to the circuit assembly after the monitoring unit 10A is manufactured and the energy storage unit 14 is inserted. This insertion or removal of the monitoring unit 10A is shown symbolically in FIG. 1 by a hand. If the monitoring unit 10A is put into storage after manufacture and the circuit assembly is permanently powered by the energy storage unit 14, said energy storage unit would discharge at least in part during a long storage period.

(19) According to the invention, it is therefore provided that the monitoring unit 10A comprising an incorporated energy storage unit 14 can be put into storage and the consumption of energy from the energy storage unit 14 is automatically interrupted or reduced during this period by actuating the switch 19 shown by way of example or a switching unit corresponding therewith. It is therefore not necessary for a user to intervene manually in order to prepare the monitoring unit 10A for storage or to configure said unit after storage.

(20) In the embodiment in FIG. 1, the switch 19 is provided in order to limit energy consumption, which switch can be actuated by the first monitoring module 15. The switch 19 is actuated on the basis of a variable operating parameter that is stored in a non-volatile data storage unit 151, preferably in a register of the monitoring unit 15, and is periodically checked by the monitoring module 15. Said variable operating parameter has a first value before the monitoring unit 10A is started up and a second value after the monitoring unit 10A has been started up. If the first value is present, the switch 19 is opened. If the second value is present, the switch 19 is closed.

(21) In order to prepare storage of the monitoring unit 10A, i.e., during manufacture or before removal of the monitoring unit 10A from the elevator system 3, the first value of the operating parameter is stored in the data storage unit 151. After the monitoring unit 10A is removed from storage and installed in the elevator system 3, this first value is overwritten by the second value. This can be carried out by a superordinate computer, e.g., the safeguard unit 1, or by the monitoring module 15 itself. If the monitoring module 15 detects, for example, that installation in the elevator system 3 has occurred and the grid-dependent first operating voltage is present, the first value of the operating parameter can be overwritten by the second value, the presence of which causes the switch 19 to close and remain closed if the grid-dependent first operating voltage drops.

(22) The first value of the operating parameter is preferably an initialization value ID0, which is implanted in all the monitoring units 10A during production. The second value ID1 of the operating parameter (or ID2 for the second monitoring unit 10B) is preferably a network address associated with the monitoring unit 10A that is assigned inside the elevator system only once and is unambiguous in this area.

(23) I.e., the switch 19 is automatically closed as a result of the integration of the monitoring unit 10A into the elevator system 3. The switch 19 is a switching transistor, for example, that is discretely arranged on the monitoring unit 10A or is integrated in the monitoring module 15. If the switch 19 is integrated in the monitoring module 15, parts of the monitoring module 15 that are not necessary for reactivating the monitoring module 15 are preferably deactivated. If a plurality of monitoring modules 15, 16 are provided, the solution according to the invention is implemented optionally identically in both monitoring modules 15, 16. In principle, the monitoring unit 10A may also comprise a plurality of switches 19, by means of which the various regions of the circuit arrangement are supplied with power. The second switching device according to the invention therefore comprises one or more discrete or integrated switching transistors.

(24) FIG. 2a shows the first monitoring unit 10A from FIG. 1, which monitoring unit switches between two operating modes, a grid mode M1 and a deep sleep mode M3, shown symbolically, on the basis of the set operating parameter ID0 and the presence of a grid-dependent operating voltage. If the grid-dependent first operating voltage fails, the first monitoring unit 10A is always in deep sleep mode M3, in which no energy or very little energy from the energy storage unit 14 is required. In said deep sleep mode M3, in which the switch 19 is open in the case of the monitoring unit from FIG. 1, the monitoring unit 10A can be stored for a long period of time without the energy storage unit 14 being discharged. If the monitoring unit 10A is installed in the elevator system in this state and the operating parameter is left on the first value ID0, the monitoring unit 10A switches into grid mode M1, in which said unit can perform all functions, when the grid-dependent first operating voltage is present. The monitoring module 15 tests the operating parameter ID0 and leaves the switch 19 open. As soon as the grid-dependent first operating voltage fails, the monitoring unit 10A switches back into deep sleep mode M3, in which the monitoring unit 10A does not perform a function for monitoring the elevator system 3.

(25) FIG. 2b shows the first monitoring system 10A from FIG. 1 after installation in the elevator system 3 and setting the operating parameter to the second value ID1. After the monitoring unit 10A is removed from storage and installed in the elevator system 3, the state of the monitoring unit 10A has switched from deep sleep mode M3 to grid mode M1. In grid mode M1, the operating parameter is set to the second value ID1 either automatically by the monitoring unit 10A or by the safeguard unit 1. The monitoring module 15 then determines that the second value ID1 is present and closes the switch 19. If the grid-dependent first operating voltage now fails, the first monitoring unit 10A changes into battery mode M2, in which the energy storage unit 14 dispenses the grid-independent second operating voltage to the monitoring module 15. When the grid-dependent operating voltage is activated and deactivated, the first monitoring unit 10A switches between grid mode M1 and battery mode M2. If the monitoring unit 10A in this configuration is removed from the elevator system and the operating parameter is not changed, the monitoring unit 10A remains in battery mode M2. When the monitoring unit 10A is removed from the elevator system, the switch 19 is thus first opened by changing the operating parameter to the first value ID0, such that the monitoring unit 10A reverts into deep sleep mode M3 and can be put into storage after the grid-dependent first operating voltage is deactivated.

(26) In FIGS. 2a and 2b, corresponding symbols, a power grid, an energy storage unit and a storage facility, are associated with the operating states M1, M2 and M3, which symbols illustrate the changes in state.

(27) As stated above, an autonomous energy storage unit 14 may also be an accumulator that is powered by light energy, for example by means of solar cells. In a preferred embodiment, any modules of an electrical system, such as circuit boards, can therefore also be provided with said autonomous energy storage unit 14. If these modules are put into storage in deep sleep mode M3, it is provided for said modules to be exposed to artificial or natural light and the accumulator 14 to therefore be regularly charged.

(28) In preferred embodiments, the solution according to the invention can also be designed to be particularly advantageous for automatic storage management and storage control. In this case, it can be provided for the monitoring units 10A, 10B, or any desired modules, to switch preferably regularly from the deep sleep mode M3 into a report mode M4 and wirelessly transmit status messages or status reports to a storage computer L1. For example, it is provided for the monitoring units 10A, 10B to switch into report mode M4 and report their status at intervals that can preferably be selected, e.g., weekly or monthly. This status report can contain the report on a test that has previously been carried out. Additionally, the monitoring units 10A, 10B revert back into deep sleep mode M3, optionally after confirmation of receipt from the storage computer L1. If all of the modules in storage are formed according to the invention, an inventory list for the entire storage facility can therefore be automatically created. Said inventory list can be compared with the updated stock ledger. If a status report reports the defect of a module, said module can be removed from storage and repaired. Due to the large time intervals, the energy required to operate the modules in report mode M4 is virtually negligible.

(29) In order to communicate with the storage computer L1 and optionally to carry out tests internally, the corresponding switching units are activated and provided with the second operating voltage. Of course, an interface is provided for wireless communication with a sending unit and preferably a receiving unit. Furthermore, a communication protocol can be implemented that allocates each module a time slot for transmission. The status reports can therefore be delivered at time intervals, controlled by a timer. Alternatively, time frames can be opened at time intervals, in which time frames the monitoring units 10A or any desired modules can be addressed and queried. As mentioned, time intervals are preferably provided in the range of days, weeks or months.

(30) The monitoring units 10A and 10B according to the invention can perform any monitoring functions in an elevator system 3 that is in operation or is inactive due to a power outage. It will be shown in the following, by way of example, that the access point to the elevator shaft 35 can be monitored by means of the monitoring units 10A and 10B.

(31) For this purpose, a monitoring signal is generated in each monitoring unit 10A, 10B from FIG. 1, which signal is carried back to an input of the monitoring unit 10A, 10B via an output port of the monitoring unit 10A, 10B and the corresponding switching contact 11A, 11B and is evaluated in a first monitoring module 15 and/or in a second monitoring module 16. The first monitoring unit 10A therefore actively feeds a monitoring signal into the elevator system 3 that is to be monitored and checks whether relevant changes to said monitoring signal occur. Alternatively, the first monitoring unit 10A could also receive passive signals that are transmitted from the elevator system 3.

(32) At least during autonomous operation of the monitoring units 10A, 10B or in battery mode M2 during a power outage, the monitoring sensors or the switching contacts 11A, 11B are monitored in order to record a change in state or an actuation of the relevant door lock 31A, 31B. Monitoring is preferably also carried out in grid mode M1. If actuation of one of the switching contacts 11A, 11B is detected while in battery mode M2, the elevator system is preferably deactivated.

(33) After the power outage has ended, the elevator system 3 is powered again with energy from the central power supply unit 2. An operating voltage is again supplied to the local power supply units 12 in the monitoring units 10A, 10B, which in turn subsequently generate the switching voltage us and activate the switch unit 13. The state data collected in the monitoring units 10A, 10B or status messages already derived therefrom can then subsequently be retrieved by the safeguard unit 1 and further processed. The safeguard unit 1 determines, on the basis of the state data from the second monitoring unit 10B, that the associated door lock 31B has been actuated and that an individual may be in the elevator shaft 35 (see FIG. 1). The safeguard unit 1 therefore prevents the elevator system 3 from being started up, by directly intervening in the elevator system 3, e.g., by deactivating the power supply 2, or by notifying a superordinate computer or the system computer 1000, which in turn prevents the elevator system 3 from being started up.

(34) FIG. 3a shows the first monitoring unit 10A from FIG. 1, which only comprises one processor-controlled first monitoring module 15 that transmits a monitoring signal s.sub.TX from an output port op to an input port ip via the switching contact 11A that is associated with the door lock 31A of the first elevator door 30A and is mechanically coupled thereto.

(35) The monitoring module 15 is, for example, a microcontroller having lowest power consumption in the operating state (preferably <100 μA) and in the idle state (preferably <500 nA), short delay times when transferring from the idle state into the operating state (preferably <1 μs), and all of the essential functions for signal processing. For example, a microcontroller is used, as is described in the documentation “MSP Low-Power Microcontrollers” from Texas Instruments Incorporated, dated 2015.

(36) The monitoring module 15 shown in FIG. 3a is a microcontroller having a CPU 150, one or more registers REG 151, a main memory RAM 152, an optionally provided digital/analog converter DAC 153, at least one output module P1 154, an interface component I/O 155, a watchdog timer WD 156, at least one additional timer T1 157, an analog/digital converter ADC 158, and at least one input module P2 159. The individual modules are or can be connected to one another via a system bus and to the safeguard unit 1 via the interface component 155. The second monitoring module 16 from FIG. 1 is preferably configured identically to the first monitoring module 15, but is provided with correspondingly adapted software.

(37) An operating program BP and preferably a filter program FP are stored in the main memory 152. The values of the operating parameter can be read out from the data storage unit 151 by means of the operating program BP. The switch or switching transistor 19 is controlled by the output port 1541 on the basis of the read-out value ID0 or ID1. In the present state, the second value ID1 is stored, in the presence of which value the switch 19 is closed and the monitoring unit 10A goes into battery mode M2 as soon as the grid-dependent first operating voltage fails. The state of the switch unit 13 shows that the power has actually failed and the monitoring module 15 is being supplied with power from the energy storage unit 14.

(38) Via an additional output port op and an amplifier 18, a monitoring signal s.sub.TX, which is generated in the monitoring module 15, can be transmitted to an input port ip of the monitoring module 15 via the switching contact 11A.

(39) FIG. 3b shows, by way of example, a monitoring signal s.sub.TX1, emitted at the output port, from FIG. 2a in the state M1 or M2 as a pulse sequence having a pulse duty cycle of 50%. A comparison of the monitoring signal s.sub.TX emitted at the output port op with the monitoring signal s.sub.RX received at the input port indicates whether the switching contact 11A has been opened during the transmission. If some of the pulses are not transmitted, a change in state of the switching contact 11A and thus a possible opening of the elevator door 30A is recorded and reported. For example, the number of pulses sent and the number of pulses received are stored in the register 151 and are compared with one another before the elevator system 3 is started up, in order to detect a door being opened.

(40) FIG. 3c shows a monitoring signal s.sub.TX2 from FIG. 2a, emitted at the output port op, in the state M1 or M2 as a pulse sequence having a pulse duty cycle of approximately 7% and a cycle duration T that is higher by a factor of 7 in comparison with the signal from FIG. 2b. By reducing the pulse duty cycle and increasing the cycle duration, the energy required can be significantly reduced.

(41) Between two pulses of the monitoring signals s.sub.TX1 and s.sub.TX2, the monitoring module 15 can also be put into an idle state in which the power consumption is minimal and only circuit parts that are necessary for the transition from the idle state into the operating state are operated. For example, external stimuli or wake-up signals are monitored. Advantageously, a wake-up signal may also be generated inside the monitoring module 15 by a timer 156, 157, for example. Said sleep mode differs from deep sleep mode M3 in that more circuit modules remain in an active mode. For example, the watchdog 156 that is not required in deep sleep mode M3 remains active.

(42) FIG. 4a shows the first monitoring unit from FIG. 3a in battery mode M2, comprising the first monitoring module 15, which transmits a monitoring signal s.sub.TX from the output port op to the input port ip of a second process-controlled monitoring module 16 via the switching contact 11A. Both of the monitoring modules 15, 16 are powered by the energy storage unit 14. In the first monitoring module 15, the number of pulses sent is recorded in the register 151. In the second monitoring module 16, the number of pulses received is recorded in a register 161.

(43) FIG. 4b shows the monitoring signal s.sub.TX from FIG. 4a as a pulse sequence having a pulse duty cycle of 50% before transmission via the switching contact 11A.

(44) FIG. 4c shows the monitoring signal s.sub.RX from FIG. 4a after transmission via the switching contact 11A, which opened during the transmission of two pulses that were not recorded in the register 161 of the second monitoring module 16. The change in state of the switching contact 11A can be established by comparing the contents of the registers 151, 161. The comparison of the contents of the registers 151, 161 can be carried out in one of the monitoring modules 15, 16, in a local comparator 17, or centrally in the safeguard unit 1, which reads out all the register contents from the monitoring units 10A, 10B.

(45) In this embodiment of the monitoring units 10A, both the monitoring units 15, 16 transition into deep sleep mode M3. For this purpose, the operating parameter can be stored and monitored in each of the monitoring modules 15, 16. However, the operating states M1, M2 and M3 can also be centrally controlled only by one of the process-controlled monitoring modules 15, 16.

(46) In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.