Method and apparatus for controlling an elevator system

Abstract

An elevator system drive unit moves an elevator car in an elevator shaft to at least two shaft access doors under control of a control unit. The car does not move or moves only to a limited extent if an individual is in the shaft. A monitoring unit and sensor (switching contact) detect changes in state in at least one of the doors using a sequence of pulses monitoring signal. The monitoring unit has a battery and can be switched to an autonomous mode when the elevator system is entirely or partially disabled. The monitoring unit, in the autonomous mode, records state data from the sensor and is connected to a safeguard unit that reads and evaluates the recorded state data, and prevents the elevator system from being put into the normal mode of operation if a change in the state of one of the monitored doors has been detected.

Claims

1. A method for safely controlling an elevator system, the elevator system including a drive unit for moving an elevator car in an elevator shaft and being controlled in a safe manner by a control device, comprising the steps of: in a normal mode of operation of the elevator system, moving the elevator car to at least two doors providing access to the elevator shaft from outside the elevator shaft, the doors being controlled by the control device, a door lock being associated with one of the doors by which the associated door can be unlocked and opened even in the case of a failure of electrical power to the elevator system; preventing the elevator car from moving or allowing movement only to a limited extent if an individual is in the elevator shaft; providing a monitoring unit and a monitoring sensor associated with the associated door for detecting state changes including unlocking or opening of the associated door; wherein the monitoring unit is equipped with a battery and is switched to an autonomous mode when the elevator system is entirely or partially disabled; wherein the monitoring unit is connected to the monitoring sensor and monitors a state of the monitoring sensor at least during the autonomous mode, and records state data corresponding to the state changes; wherein the monitoring unit is connected to a safeguard unit that reads the recorded state data from the monitoring unit, the safeguard unit evaluating the state data and prevents the elevator system from being put into the normal mode of operation if a change in the state of the associated door has been detected; wherein the monitoring sensor is a switching contact coupled to the door lock and a monitoring signal is transmitted from an output to an input of the monitoring unit through the switching contact, and the transmitted monitoring signal is monitored with respect to the state changes which occur upon actuation of the door lock; and wherein the monitoring signal is a sequence of pulses.

2. The method according to claim 1 characterized wherein the monitoring signal is a sequence of identical pulses, or a sequence of different pulses having an established setpoint form.

3. The method according to claim 1 wherein: the monitoring unit has a first processor-controlled monitoring module, operating the monitoring module to emit the monitoring signal at an output port to the switching contact and receive the monitoring signal from the switching contact at an input port; or the monitoring unit has first and second processor-controlled monitoring modules, operating the first monitoring module to emit the monitoring signal at an output port to the switching contact and operating the second monitoring module to receive the monitoring signal from the switching contact at an input port; or the monitoring unit has first and second processor-controlled monitoring modules, operating the first monitoring module to emit the monitoring signal at an output port to the switching contact and operating the first and second monitoring modules each to receive the monitoring signal at a respective input port.

4. The method according to claim 3 wherein: the monitoring signal emitted from the output port of the first monitoring module is supplied to a first input port of the second monitoring module through the switching contact and supplied directly to a second input port of the second monitoring module; or the monitoring signal emitted from the output port of the first monitoring module is supplied to a first input port of the second monitoring module and to an input port of the first monitoring module through the switching contact, and supplied directly to a second input port of the second monitoring module.

5. The method according to claim 3 including transmitting the pulses in time intervals within which at least one of the first and second monitoring modules is transferred to a sleep mode when a first event occurs and to an operating mode when a second event occurs, wherein the first event is an end of the recording of the state data corresponding to the state changes in the transmitted monitoring signal or expiration of a timer, and the second event is arrival of one of the transmitted pulses of the monitoring signal or the expiration of the timer.

6. The method according to claim 5 wherein the safeguard unit or at least one of the first and second monitoring modules compares the monitoring signal transmitted through the switching contact with either the monitoring signal not transmitted through the switching contact or a setpoint form of the transmitted monitoring signal, and records deviations as well as a corresponding functional error in one of the first and second monitoring modules.

7. The method according to claim 3 wherein at least one of the first and second monitoring modules has at least one register for storing the state data, a number of the pulses sent and a number of the pulses received are stored in the at least one register, and a difference between the stored number of the pulses sent and the stored number of the pulses received is formed in at least one of the first and second monitoring modules or in the safeguard unit and represents a state change that may have occurred.

8. The method according to claim 3 wherein at least one of the first and second monitoring modules includes a filter program that filters the received monitoring signal and functions as a low-pass filter or median filter to establish whether a number of the monitoring signal pulses that have arrived is greater or smaller than half a number of expected or sent ones of the monitoring signal pulses.

9. The method according to claim 1 including supplying the monitoring signal transmitted through the switching contact to an input of a watchdog timer that is reset with each arrival of the pulses of the monitoring signal, and that increments up to a timeout and signals a state change when one of the pulses of the monitoring signal is missing.

10. The method according to claim 3 including passing the monitoring signal emitted from the output port of the first monitoring module is passed through the switching contact to the input port of the first monitoring module and is monitored, and wherein the first monitoring module, after an absence of an expected pulse, emits a plurality of pulses with a pulse repetition frequency that is increased by the predetermined factor with respect to a pulse frequency of the monitoring signal, the plurality of pulses being supplied to the first input port of the second monitoring module through the switching contact as well as directly to the second input port of the second monitoring module.

11. The method according to claim 3 including, during the autonomous mode of the monitoring unit, resetting the first and second monitoring modules and deleting the stored state data in response to at least one of a voltage from the battery falls below a threshold value and a brownout is occurring in one of the first and second monitoring modules.

12. The method according to claim 1 wherein the safeguard unit reads the recorded state data from the monitoring unit and performs at least one of: checks a functionality of monitoring unit; establishes any state changes or malfunctions that have occurred in the monitoring unit; determines deviations in numbers of the transmitted and received pulses recorded in the monitoring unit; and if there is a missing functionality of the monitoring unit, or if a state change has occurred in the monitoring unit, or if there is a deviation in the numbers of the transmitted and received pulses recorded in the monitoring unit, the safeguard unit prevents the elevator system from being transferred back to the normal mode of operation.

13. An elevator system having a drive unit connected to an elevator car located in an elevator shaft and controlled by a control device, wherein in a normal mode of operation, the elevator car can be moved to at least two doors providing access to the elevator shaft from outside the elevator shaft, the doors being controlled by the control device, a door lock being associated with at least one of the doors by which door lock the associated door can be unlocked and opened even in the case of a power failure, and wherein the elevator car is prevented from moving or enabled to move only to a limited extent if an individual is in the elevator shaft, comprising: a monitoring unit and a monitoring sensor associated with at least one of the doors for detecting state changes such as unlocking or opening of the at least one door; wherein the monitoring unit is equipped with a battery and can be switched to an autonomous mode when the elevator system is entirely or partially disabled; wherein the monitoring unit is connected to and monitors the monitoring sensor and records the state changes at least during the autonomous mode; wherein the monitoring unit is connected to a safeguard unit for assessing the state changes in the at least one door and preventing the elevator system from being placed in the normal mode of operation; wherein the monitoring sensor is a switching contact coupled to the door lock associated with the at least one door, a monitoring signal being transmitted from an output to an input of the monitoring unit, and the transmitted monitoring signal being monitored with respect to the state changes which occur upon actuation of the door lock associated with the at least one door; and wherein the monitoring signal is a sequence of pulses.

14. The elevator system according to claim 13 wherein: the monitoring unit has a first processor-controlled monitoring module having an output port from which the monitoring signal is transmitted through the switching contact to an input port of the first monitoring module; or the monitoring unit has the first monitoring module having the output port from which the monitoring signal is transmitted through the switching contact to an input port of a second monitoring module.

15. The elevator system according to claim 14 wherein: the monitoring signal from the output port of the first monitoring module is transmitted to a first input port of the second monitoring module through the switching contact and is directly transmitted to a second input port of the second monitoring module; or the monitoring signal from the output port of the first monitoring module is transmitted to the first input port of the second monitoring module and to an input port of the first monitoring module through the switching contact, and is transmitted directly to the second input port of the second monitoring module.

Description

DESCRIPTION OF THE DRAWINGS

(1) The apparatus according to the invention shall be described hereinbelow in preferred embodiments by way of example, with reference to the drawings. In the drawings,

(2) FIG. 1 illustrates an elevator system 3 according to the invention, having a drive unit 38 which allows an elevator car 36 located in an elevator shaft 35 to move between two elevator doors 30A, 30B, and a control device 100 that has, in order to monitor the elevator system 3, a safeguard unit 1 that is connected or can be connected to monitoring units 10A, 10B by means of each of which a lock 31A, 31B of an associated 30A, 30B is monitored;

(3) FIG. 2a illustrates the first monitoring unit 10A of FIG. 1, which has a processor-controlled monitoring module 15 that transmits a monitoring signal s.sub.TX from an output port op via a switching contact 11A that is associated with the door lock 31A of the first elevator door 30A to an input port ip;

(4) FIG. 2b illustrates a monitoring signal s.sub.TX1 emitted at the output port op, as a pulse sequence having a duty cycle of 50%, selected by way of example;

(5) FIG. 2c illustrates a monitoring signal s.sub.TX2 emitted at the output port op as a pulse sequence having a duty cycle of approximately 7% and a cycle duration T increased by a factor of 7;

(6) FIG. 2d illustrates the monitoring signal s.sub.RX2 arriving at the input port ip, into which an interference pulse n has been applied via the switching contact 11A during the transmission;

(7) FIG. 3a illustrates the first monitoring unit of FIG. 2a, having the first monitoring module 15, which transmits a monitoring signal s.sub.TX via the switching contact 11A to a second processor-controlled monitoring module 16;

(8) FIG. 3b illustrates the monitoring signal s.sub.TX from FIG. 3a, as a pulse sequence having a duty cycle of 50% before the transmission via the switching contact 11A;

(9) FIG. 3c illustrates the monitoring signal s.sub.RX from FIG. 3b after the transmission via the switching contact 11A, which has opened during the duration of two pulses that were not recorded in the register 161 of the second monitoring module 16;

(10) FIG. 4a illustrates the first monitoring unit from FIG. 3a, with the first monitoring module 15, the output port op thereof which is connected on the one side to a first input port ip1 of the second monitoring module 16 via the switching contact 11A and on the other side directly to a second input port ip2 of the second monitoring module 16;

(11) FIG. 4b illustrates the monitoring signal s.sub.TX from FIG. 4a that is emitted at the output port op of the first monitoring module 15;

(12) FIG. 4c illustrates the monitoring signal s.sub.RX from FIG. 4a arriving at the first input port ip1 of the second monitoring module 16;

(13) FIG. 5a illustrates the first monitoring unit from FIG. 4a, with which the monitoring signal s.sub.TX from FIG. 4a is additionally supplied via the switching contact 11A to an input port ip of the first monitoring module 15;

(14) FIG. 5b illustrates the monitoring signal s.sub.TX from FIG. 5, as a pulse sequence having a duty cycle of approximately 7% before the transmission via the switching contact 11A, with an additionally-applied auxiliary pulse p.sub.AUX, that is additionally emitted from the first monitoring module 15 after an expected pulse of the transmitted monitoring signal s.sub.RX fails to appear;

(15) FIG. 5c illustrates the monitoring signal s.sub.RX from FIG. 5b after the transmission via the switching contact 11A, which has been opened after the arrival of a first pulse p;

(16) FIG. 6a illustrates a diagram with the transmitted monitoring signal s.sub.TX2 from FIG. 2, with the transmitted monitoring signal s.sub.RX2 from FIG. 2d that is provided with an interference pulse n, with schematically-illustrated filtering measures and with the filtered monitoring signal s.sub.RXF, which has been shifted by more than two sampling cycles relative to the received monitoring signal s.sub.RX2;

(17) FIG. 6b illustrates a diagram with the sent monitoring signal s.sub.TX from FIG. 3b, with the transmitted monitoring signal s.sub.RX lacking three pulses, with schematically-illustrated filter measures, and with the filtered monitoring signal s.sub.RXF that has been shifted by two sampling cycles relative to the received monitoring signal s.sub.RX;

(18) FIG. 6c illustrates a diagram with the sent monitoring signal s.sub.TX from FIG. 5b in which the pulse repetition frequency has been doubled after the failure of a pulse, with the transmitted monitoring signal s.sub.RX lacking three pulses, with schematically-illustrated filter measures, and with the filtered monitoring signal s.sub.RXF that has been shifted by two sampling cycles relative to the received monitoring signal s.sub.RX but has a halved cycle duration;

(19) FIG. 7 illustrates a diagram with two waveforms of the monitoring signal s.sub.TX1, s.sub.TX2 to be transmitted, the waveform of the transmitted monitoring signal s.sub.RX, the waveform at the output of a timer in the second monitoring module 16, and the received monitoring signal s.sub.RXF after the filtering; and

(20) FIG. 8 illustrates a diagram with a waveform of a monitoring signal s.sub.TX generated in the first monitoring module 15, with three different variants A, B, C of pulses that have different pulse widths, and the waveform of the monitoring signal s.sub.RX that is received in the second monitoring module 16, in which three pulses (shown with hatching) of the variants A and C are not present or are not correct.

DETAILED DESCRIPTION

(21) FIG. 1 illustrates an elevator system 3 according to the invention, with a drive unit 38 that allows an elevator car 36 located in an elevator shaft 35 to move between two elevator doors 30A, 30B. The elevator system 3, which is powered by a central power supply unit 2, is equipped with a control device 100 by means of which the elevator system 3in particular, the drive unit 38can be controlled. The control device 100, in order to monitor the elevator system 3, comprises a safeguard unit 1 that is connected or can be connected to monitoring units 10A, 10B, by means of each of which a lock 31A, 31B of an associated elevator door 30A, 30B can be monitored.

(22) The safeguard unit 1, in the present embodiment, is a stand-alone computer system that communicates with a system computer 1000. The safeguard unit 1 may, however, also be integrated into the system computer 1000 as a software module or hardware module. The safeguard unit 1 can, as illustrated in FIG. 1, intervene directly in the elevator system 3 and, for example, control or turn off the power supply 2 or the drive unit 38. Alternatively, the safeguard unit 1 may be connected only to the system computer 1000, which, in turn, executes the safeguarded control of the elevator system 3 by taking into account the state data that has been determined according to the invention.

(23) The safeguard unit 1 and/or the system computer 1000 may additionally be connected to external computer unitse.g., a host computerwirelessly or via a wired connection.

(24) In the present embodiment, the monitoring sensors 11A, 11B configured as switching contacts that are each mechanically coupled to a door lock 31A, 31B that can be actuated by maintenance personnel by means of a tool, such as is illustrated in FIG. 1 for the switching contact 11B. During a power failure or shut-down of the power supply, the maintenance personnel can thus actuate a door lock 31A, 31B, manually open an elevator door 30A, 30B, and enter the elevator shaft 35.

(25) FIG. 1 shows that after a power failure, the lower elevator door 31B has been opened and a maintenance technician has entered the elevator shaft 35 in order to test an electrical installation 8 that could have caused the power failure. The maintenance technician stands on the shaft bottom in a shaft pit that has only a shallow depth. In this situation, the elevator system 3 must not be operated. In the upper level, a building resident moves to the first elevator door 30A, behind which the elevator car 36 stands. If the power supply to the elevator system 3 is restored in this moment and the normal mode of operation is activated, the building resident can enter and start the elevator car 36. This is prevented by monitoring of the switching contacts 11A, 11B and prevention of the transition into the normal mode of operation if one of the switching contacts 11A, 11B has been actuated. So that this monitoring can be carried out even after a power failure, the monitoring units 10A, 10B are equipped with a battery 14, and can automatically be switched to an autonomous mode if the elevator system 3 has been partially or completely shut down or if there is a power failure.

(26) FIG. 1 shows that the two identically-configured monitoring units 10A, 10B each have a local power supply unit 12 and a battery 14, both of which can be connected to a first and optionally a second monitoring module 15, 16 via a controllable switch unit 13, e.g., a voltage-controlled relay. The switch unit 13 is powered by the power supply unit 12 with a switching voltage us, by which the switch unit 13 is activated and connects the power supply unit 12 to the monitoring modules 15, 16. If there is a power failure, the switching voltage us is dropped and the switch unit 13 falls back to the rest position, in which the battery 14 is connected to the monitoring modules 15, 16.

(27) In each of the monitoring units 10A, 10B, the first monitoring module 15 generates a monitoring signal that is passed via an output of the monitoring unit 10A, 10B and the associated switching contact 11A, 11B back to an input of the monitoring unit 10A, 10B and assessed in the first or second monitoring module 15, 16.

(28) At least during the autonomous mode or during a power failure, therefore, the monitoring sensors or the switching contacts 11A, 11B are monitored in order to record a state change or an actuation of the associated door lock 31A, 31B. Monitoring is preferably also carried out during the normal mode of operation. If actuation of one of the switching contacts 11A, 11B is detected during the normal mode of operation, then the elevator system is preferably switched off.

(29) After the power failure has ended, the elevator system 3 is powered again with energy from the central power supply unit 2. An operating voltage is again supplied to the local power supply units 12 in the monitoring units, which in turn subsequently generate the switching voltage us and activate the switch unit 13. The state data collected in the monitoring units 10A, 10B or status messages already derived therefrom can then subsequently be retrieved by the safeguard unit 1 and further processed. The safeguard unit 1 determines, by consulting the state data from the second monitoring unit 10B, that the associated door lock 31B has been actuated, and that an individual may possibly be present in the elevator shaft 35. The safeguard unit 1 therefore prevents the elevator system 3 from being started up, by direct intervention in the elevator system 3, such as is illustrated in FIG. 1 with the shutdown of the power supply 2 or shutdown of the drive unit 38, or by notification to a higher-level computer or the system computer 1000, whichin turnprevents the elevator system 3 from being started up.

(30) Instead of providing a separate monitoring unit 10A, 10B for each elevator door 30A, 30B, as in FIG. 1, it would also be possible to provide a single monitoring unit that monitors a plurality of switching contacts each associated with an elevator door. The switching contacts are connected in series in this case, so that the monitoring unit recognizes when one of the two switching contacts is opened. In this case, too, only a single battery is necessary to power the monitoring unit.

(31) The design of the monitoring units 10A, 10B will be described hereinbelow in different preferred embodiments, in which particular importance is given to the safety of the monitoring, the functionality of the monitoring apparatus, andin particularthe energy savings for discharging the battery 14.

(32) FIG. 2a illustrates the first monitoring unit 10A of FIG. 1, which has only one processor-controlled first monitoring module 15 that transmits a monitoring signal s.sub.TX from an output port op via the switching contact 11Athat is associated with the door lock 31A of the first elevator door 30A and mechanically coupled theretoto an input port ip.

(33) The monitoring module 15 is, for example, a microcontroller having lowest power consumption in the operating mode (preferably <100 A) and in the sleep mode (preferably <500 nA), short delay times in the transition from the sleep mode to the operating mode (preferably <1 s), and all of the essential functions for signal processing. For example, a microcontroller is used, such as is described in the documentation MSP Low-Power Microcontrollers from Texas Instruments Incorporated, dated 2015.

(34) The monitoring module 15 illustrated in FIG. 2a is a microcontroller with a CPU 150, one or more registers 151, a memory 152, an optionally-provided digital/analog converter 153, at least one output module 154, an interface component 155, a watchdog timer 156, at least one other timer T1 157, an analog/digital converter 158, and at least one input module 159. The individual modules are connected or can be connected to one another via a system bus, and to the safeguard unit 1 via the interface component 155.

(35) The second monitoring module 16 from FIG. 1 is preferably configured identically to the first monitoring module 15, but provided with correspondingly adapted software. Preferably, both monitoring modules 15, 16 are provided with test circuits or brownout circuits that make it possible to establish whether the operating voltagein particular, the voltage of the battery 14has fallen under a provided value and/or whether individual circuit parts are only insufficiently powered, following which same is recorded accordingly. Preferably, the monitoring module 15 is returned to the output le 15.

(36) An operating program BP and a filter program FP are stored in the memory 152. Via an output port op and an amplifier 18, a monitoring signal s.sub.TX that is generated in the monitoring module 15 can be transmitted via the switching contact 11A to an input port ip of the monitoring module 15.

(37) The state of the switch unit 13 indicates that the current has failed and the monitoring module 15 is being supplied with current from the battery 14.

(38) FIG. 2b illustrates a monitoring signal s.sub.TX1 emitted at the output port op, as a pulse sequence having a duty cycle of 50%, by way of example. Comparison of the monitoring signal s.sub.TX emitted at the output port op with the monitoring signal s.sub.RX received at the input port indicates whether the switching contact 11A has been opened during the transmission. If some of the pulses are not transmitted, then a state change in the switching contact 11A and thus a possible opening of the elevator door 30A is recorded and reported. For example, the number of pulses sent and the number of pulses received are stored in the register 151, and compared against one another before the elevator system 3 is started up, in order to detect a door opening.

(39) FIG. 2c illustrates a monitoring signal s.sub.TX2 from FIG. 2a, emitted at the output port op, as a pulse sequence with a duty cycle of approximately 7% and a cycle duration T that is higher by a factor of 7 as compared to the signal from FIG. 2b. Reducing the duty cycle and increasing the cycle duration makes it possible to significantly reduce the energy required. Between two pulses, the monitoring module 15 may also be put into a sleep mode in which the power consumption is minimal and only circuit parts that are necessary for the transition from the sleep mode to the operating mode are operated. For example, external stimuli or wake-up signals are monitored. Advantageously, a wake-up signal may also be generated within the monitoring module 15, for example, from a timer 156, 157.

(40) FIG. 2d illustrates the monitoring signal s.sub.RX2 arriving at the input port ip, into which an interference pulse n has been applied via the switching contact 11A during the transmission. Interferences of this type can affect the monitoring and are preferably filtered out. For this purpose, the filter program FP is implemented in the monitoring module 15, as shall be described hereinbelow in a preferred embodiment.

(41) FIG. 3a illustrates the first monitoring unit of FIG. 2a, having the first monitoring module 15, which transmits a monitoring signal s.sub.TX from the output port op via the switching contact 11a to the input port ip of a second processor-controlled monitoring module 16. The two monitoring modules 15, 16 are powered by the battery 14. In the first monitoring module 15, the number of pulses sent is recorded in the register 151. In the second monitoring module 16, the number of the received pulses is recorded in a register 161.

(42) FIG. 3b illustrates the monitoring signal s.sub.TX from FIG. 3a, as a pulse sequence having a duty cycle of 50% before the transmission via the switching contact 11A.

(43) FIG. 3c illustrates the monitoring signal s.sub.RX from FIG. 3b after the transmission via the switching contact 11A, which has opened during the transmission of two pulses that were thus not recorded in the register 161 of the second monitoring module 16. Comparing the contents of the two registers 151, 161 makes it possible to establish the state change of the switching contact 11A. The comparison of the content of the registers 151, 161 can be performed in one of the monitoring modules 15, 16, in a local comparator 17, or centrally in the safeguard unit 1, which reads out all of the register contents from the monitoring units 10A, 10B.

(44) FIG. 4a illustrates the first monitoring unit 10A from FIG. 3a, with the first monitoring module 15, the output port op thereof which is connected on the one side to a first input port ip1 of the second monitoring module 16 via the switching contact 11A and on the other side directly to a second input port ip2 of the second monitoring module 16.

(45) The pulses transmitted directly to the second input port ip2 can be used as reference signals or as wake-up signals. With use as a reference signal, changes in the monitoring signal s.sub.RX that is transmitted via the switching contact 11A but has not, in this case, been filtered yet can be recognized immediately.

(46) The monitoring signal s.sub.TX arriving at the input port ip2 may also, however be used as a wake-up signal, after the arrival of which the second monitoring module 16 is, in each case, moved from the sleep mode to the operating mode. So that the pulses transmitted via the switching contact 11A can be detected, the pulse width must be greater than the wake-up time of the second monitoring module 16 of, for example, 1 s. For example, a pulse width of 25 swhich makes it possible to safely recognize the incoming pulsesis selected.

(47) A wake-up signal may also be generated internally in the monitoring modules 15, 16 and synchronized with the monitoring signal s.sub.TX. As shown by the waveform wd in FIG. 7, a timerfor example, the watchdog 156can count the cycle duration of the monitoring signal s.sub.TX and move the relevant monitoring module 15 or 16 from the sleep mode to the operating mode when the maximum counter state is reached, so that the first monitoring module 15 can, for example, send out one pulse and the second monitoring module 16 can receive this pulse.

(48) FIG. 4b illustrates the monitoring signal s.sub.TX from FIG. 4b that is emitted at the output port op of the first monitoring module 15.

(49) FIG. 4c illustrates the monitoring signal s.sub.RX from FIG. 4A arriving at the first input port ip1 of the second monitoring module 16, which contains only the first pulse. The monitoring signal s.sub.TX supplied directly to the second input port ip2 may now wake up the second monitoring module 16, which, after the transition into the operating mode, establishes that the second and third pulses are missing. As mentioned, the monitoring signal s.sub.TX supplied to the second input port ip2 may also be used as a reference signal.

(50) FIG. 5a illustrates the first monitoring unit from FIG. 4a, with which the monitoring signal s.sub.TX from FIG. 4a is additionally supplied via the switching contact 11A to an input port ip of the first monitoring module 15. The interruption of the switching contact 11A may thus alternatively or simultaneously be recognized in the first and second monitoring module 15, 16.

(51) In the first monitoring module 15, the absence of a pulse is preferably used in order to change the test mode and intensify the inspection. Preferably, the pulse repetition frequency is at least briefly increased by a factor x that preferably lies in the range of 50 to 250. For example, a cycle duration in the range of 0.1 to 0.5 s is changed to a cycle duration in the range of 1 to 5 ms. With the increased pulse repetition frequency, the state of the switching contact 11A or a possible state change can successfully be quickly and precisely determined even if there are interference signals, which should be suppressed by means of the filter program FP. Delays that are caused by the filter program FP are then also reduced by the factor x.

(52) FIG. 5b illustrates the monitoring signal s.sub.TX from FIG. 5a, as a pulse sequence having a duty cycle of approximately 7% before the transmission via the switching contact 11a, with an additionally-applied auxiliary pulse p.sub.AUX, that is additionally emitted from the first monitoring module 15 after an expected pulse p of the transmitted monitoring signal s.sub.RX fails to appear. The auxiliary pulse p.sub.AUX illustrates symbolically that the monitoring signal is changed as needed s.sub.TX, in order to be able to execute a quick inspection.

(53) FIG. 5c illustrates the monitoring signal s.sub.RX from FIG. 5b after the transmission via the switching contact 11A, which has been opened after the arrival of a first pulse p.

(54) FIG. 6a illustrates a diagram with the sent monitoring signal s.sub.TX2 from FIG. 2c and with the transmitted monitoring signal s.sub.RX2 from FIG. 2d provided with an interference pulse n. Also illustrated schematically are filter measures and the filtered monitoring signal s.sub.RXF, which is offset by more than two sampling cycles from the received monitoring signal s.sub.RX2 and from which the interference pulse has been removed. The measurement is done at the output of the filter stage, which is implemented with hardware or software, with a significant delay.

(55) The filter program FP, which is implemented in the second monitoring module 16, checks what value the majority of sample values within a filter interval have. The filter intervals each include the last five sample values. The filter program FP comprises, for example, a FIFO register into which the sample values can be read in in a stepwise manner. With each shift, the sum of the five values contained in the FIFO register is formed and checked for whether the sum is above or below the average value between the values where the FIFO register is completely filled or completely emptied, i.e., greater or smaller than 2.5. The values determined and the result are indicated for each filter interval. The transmission to the output of the filter takes place with the delay d only after the last sample value has arrived.

(56) FIG. 6a shows that the filtered monitoring signal s.sub.RXF appears with a delay dthat corresponds approximately to twice the cycle duration of the sample signalat the output of the filter stage. The sporadically-occurring interference pulse n has, however, been remedied.

(57) FIG. 6b illustrates a diagram with the sent monitoring signal s.sub.TX from FIG. 3b, and the transmitted monitoring signal s.sub.RX that is missing three pulses. Also illustrated schematically are filter measures and the filtered monitoring signal s.sub.RXF, which is likewise offset by approximately two sampling cycles from the received monitoring signal s.sub.RX2 with a delay d1. The filter operation is performed as described with reference to FIG. 6a.

(58) FIG. 6c illustrates a diagram with the sent monitoring signal s.sub.TX from FIG. 5b, and the transmitted monitoring signal s.sub.RX that is missing three pulses. When the monitoring signal s.sub.TX is sent, the pulse repetition frequency was doubled after the absence of a pulse was detected (see also the description of FIG. 5a). Also illustrated schematically are filter measures and the filtered monitoring signal s.sub.RXF, which is offset by two sampling cycles from the received monitoring signal s.sub.RX with a delay d2, but has a halved cycle duration. The delay d2 has likewise been halved from the delay d1 from FIG. 6b (d2=d1).

(59) At the t3, it has been established in the first monitoring module 15 from FIG. 5a that an expected pulse has not arrived with the transmitted monitoring signal s.sub.RX. After this event, the pulse repetition frequency has been doubled by the first monitoring module 15, and thus the pulse interval has been halved. The length of the filter intervals and the delay d can thus be reduced discretionarily, by increasing the pulse repetition frequency.

(60) In a preferred embodiment, it is provided that after the absence of a pulse, for a short duration in the range of, for example, 1 to 10 seconds, the first monitoring module 15 sends out a burst or sequence of pulses having intervals reduced by the above-mentioned factor x, which preferably is in the range of 50 to 250.

(61) FIG. 7 illustrates a diagram with two waveforms of the monitoring signal s.sub.TX1, s.sub.TX2 to be transmitted, and the waveform of the transmitted monitoring signal s.sub.RX. Also illustrated are the waveform wd at the output of a timer in the second monitoring module 16 and the received monitoring signal s.sub.RXF after the filtering. The timer corresponds, for example, to the watchdog 156 of the first monitoring module 15.

(62) FIG. 7 indicates that the change in the waveform of the transmitted monitoring signal s.sub.RX can have two different causes.

(63) In the first case, there may beat the time t5a state change in the switching contact 11A, which is interrupted and does not pass the pulses of the first monitoring signal s.sub.TX1 on to the input port ip1 of the second monitoring module 16.

(64) In the second case, the monitoring signal s.sub.TX2 is no longer generated in the first monitoring module 15, so that after the time t4, no more pulses can pass via the closed switching contact 11A to reach the input port ip1 of the second monitoring module 16. If the pulses of the monitoring signal s.sub.TX2, with the circuit arrangements in FIGS. 4a and 5a, no longer reach the second input port ip2 of the second monitoring module 16, then same is no longer transferred from the sleep mode to the operating mode. The counter states for the sent and received pulses therefore remain constant or are frozen. If the counter states have been frozen with identical values, this indicates the closed state of the monitored switching contact 11A, 11B, although same may perhaps have been opened in the meantime.

(65) The invention proposes two solutions to this problem, which are applied either alternatively or preferably in combination.

(66) In the first solution variant, a wake-up signal s.sub.T1 is generated by a timer 157 within the second monitoring module 16 (which preferably has the same modules as the first monitoring module 15). The wake-up signal s.sub.T1 is synchronized with the monitoring signal s.sub.TX emitted from the first monitoring module 15, and has the same frequency, but has been shifted forward by a fraction of the cycle duration. With the falling edge of the wake-up signal s.sub.T1, the second monitoring module 16 is in each case transferred from the sleep mode to the operating mode, in order to receive a pulse of the transmitted monitoring signal s.sub.RX. As a result, the actual value of the pulses that actually arrived and the setpoint value of the expected pulses are recorded, such as is illustrated in FIG. 7. The difference between the 4 pulses that arrived and the 14 pulses that were expected indicates that a state change has occurred in the first monitoring module 15 or at the switching contact 11A.

(67) If the pulses of the monitoring signal s.sub.TX1, s.sub.TX2 are also counted at the second input port ip2 of the second monitoring module 16, the state of the first monitoring module 15 can be determined. The counter states of the register 161 show that 14 pulses have been sent out from the first monitoring module, that 14 pulses were expected, and that four pulses were transmitted via the switching contact 11A. The concordance of 14 emitted and 14 expected pulses shows that the first monitoring module 15 is functioning properly. The difference between the 14 sent and expected pulses on the one hand and the four received pulses on the other hand indicates, however, that the switching contact 11A has been opened. The received and filtered monitoring signal s.sub.RXF shows the state change of the switching contact 11A.

(68) In the second solution variant, the counter states of the registers 151, 161 are read out by the safeguard unit 1 after the end of the power failure from all of the monitoring units 10A, 10B, and compared against one another. The comparison shows whether the register states are frozen at one of the monitoring units 10A, 10B and an error has occurred. If the register states in each of the monitoring units 10A, 10B are identical but there are differences between the monitoring units 10A, 10B, then a functional error can be deduced.

(69) When the counter states are processed, tolerances are preferably provided, with which deviations of counter states that are insufficient for indicating a malfunction or a state change in the monitoring sensors or switching contacts 11A, 11B are neglected.

(70) FIG. 2a shows that the monitoring modules 15, 16 preferably have a so-called watchdog 156 that is configured as a timer or counter and advantageously can be used to monitor the switching contact 11A or 11B or even the first monitoring module 15. With the circuit arrangements in FIGS. 4a and 5a, the monitoring signal s.sub.TX with the pulse sequences (see, for example, FIG. 7 with the waveforms s.sub.TX1 and s.sub.TX2) is supplied to the second input port ip2 directly/not via the switching contact 11A/11B of the second monitoring module 16. The monitoring signal s.sub.RX transmitted via the switching contact 11A/11B is supplied to the first input ip1 of the second monitoring module 16. The absence of a pulse of the monitoring signals s.sub.TX1 or s.sub.TX2 or s.sub.RX supplied to the first and/or second input port ip1/ip2 can now be monitored with reference in each case to a watchdog 156, for which a timeout or count value that is never achieved with regular arrival of all of the pulses is established. FIG. 7 illustrates the monitoring of the monitoring signal s.sub.RX transmitted via the switching contact 11A/11B, the pulses of which each reset the watchdog 156 on the rising edge, so that the watchdog cannot increment to the timeout to. At the time t5, however, pulses are no longer transmitted via the switching contact 11A/11B, so that the watchdog 156 is not reset and increments to the timeout, triggering an alarm or signaling a state change. In the same manner, the monitoring signal s.sub.TX2 illustrated in FIG. 7 would cause a timeout at a second watchdog at the time t5.

(71) It is preferably provided that the filtered input signal s.sub.RXF is supplied to the watchdog 156. This prevents the watchdog 156 from being reset by interference pulses and being unable to increment to the timeout in the absence of a pulse of the monitoring signal s.sub.RX.

(72) The state changes signaled by the watchdog 156 are, for example, stored in the register 151 and transmitted to the safeguard unit 1 with the other state data after the power failure has ended. Preferably, the waveform of the output signal of the watchdog 156 is stored and analyzed, for example, in order to establish the duration of the interruptions of the switching contact 11A/11B. Normally, it is provided that the elevator system 3 is prevented from being started up already after the arrival of a timeout for a pulse. Alternatively, it may be established that the timeout must be changed for a certain number of pulses before the elevator system 3 is prevented from being started up. This distinguishes, for example, whether an irregularity in the circuit or a door opening has occurred.

(73) FIG. 8 illustrates a diagram with a waveform of a monitoring signal s.sub.TX generated in the first monitoring module 15, with three different variants A, B, C of pulses that have different pulse widths. Also illustrated is the waveform for the monitoring signal s.sub.RX received in the second monitoring module 16, in which three pulses of the variants A and C are not present or are not correct. The number of pulses emitted is recorded in the register 151 of the first monitoring module 15 for each of the variants A, B, and C. The number of the received pulses for each of the variants A, B, and C is likewise recorded in the register 161 of the second monitoring module 16.

(74) The pulses can be lost or affected over the entire transmission path. Analyzing the changes makes it possible to deduce the type of interference. The electronic elements of the monitoring modules 15, 16 and thus easily be inspected by means of the variation in the pulses. The inspection may be carried out sporadically or also in a regular pattern by the safeguard unit 1, or autonomously by the monitoring modules 10A, 10B.

(75) Alternatively, the pulse amplitudes, pulse intervals, or the pulse repetition frequency may also be selectively changed.

(76) After a power failure has ended or a simulation of a power failure has ended, the safeguard unit 1 reads out the recorded state data from all of the connected monitoring units 10A, 10B and the monitoring modules 15, 16 provided therein, and carries out an analysis.

(77) In accordance with the provisions of the patent statutes, the present invention has been described in what is considered to represent its preferred embodiment. However, it should be noted that the invention can be practiced otherwise than as specifically illustrated and described without departing from its spirit or scope.