Fresenius Medical Care 4008 E Technical Manual page 355

Regular operation:
After a program runtime of 500 ms has elapsed, a function is called in, which releases a short-
time pulse at a digital output (PAL 16V8). This pulse causes the first monoflop (MF1) to be
triggered and the inverted output pin 7 to turn to L level. This, in turn, causes monoflop 2 (MF2) to
be triggered with its output pin 10 turning to H level. As a result, the reset input of the D-flip-flop
becomes inactive.
The D-flip-flop is set by a pulse emitted by CPU 2 (WD_RESET). The 24-V relay is switched on by
the H level at output pin 9 (WD_OUT) via a following amplifier stage.
The watchdog is activated.
After the switch-on time of MF1 (approx. 400 ms) has elapsed, the inverted output (pin 7) turns to
H level, thus deactivating the trigger input of MF2 (pin 11).
If the next trigger pulse for MF1 arrives within the time span prescribed, the output of MF1 returns
to L level, thus retriggering MF2. Since the output pin 10 remains at H level, the D-flip-flop
remains set.
Triggering too rapid:
Should MF1 be triggered too frequently, i.e. repeatedly during a specified time span, the switch-
on time of MF1 will not elapse (permanent retriggering). The inverted output of MF1 continuously
remains at L level. As a result, MF2 no longer receives any trigger edges and de-energizes after
approx. 670 ms. Consequently, the 24-V relay will not be energized. It will de-energize ("safe
state").
Triggering too slow or missing:
Should too long a time span elapse until the trigger pulse for MF1 arrives, MF2 also de-energizes
after approx. 670 ms, thus turning its output to L level.
Consequently, the 24-V relay will not be energized. It will de-energize ("safe state").
Initial watchdog test:
After the hemodialysis machine has been switched on and the input/output modules have been
initalized by the computer, the hardware watchdog is checked for correct function.
The watchdog test is divided in several phases.
1st phase:
The watchdog is triggered by CPU 1 in the correct time-slot pattern, and a trigger request is
transmitted to CPU 2.
After having recognized the trigger request (prerequisite: correct communication between CPU 1
and CPU 2), CPU 2 tests the permissible voltage level (<5 V) and, with all prerequisites being
fulfilled, emits a release pulse for the output-stage flip-flop (WD_RESET). Switch-on of the 24-V
voltage is monitored via an analog input. If the voltage has achieved the correct value within a
given period of time, the 1st phase is completed successfully.
8-58
Fresenius Medical Care 4008 4/09.03 (TM)