Dual-Channel Architecture - ConMed Hyfrecator 2000 Service Manual

2000
Fault Detection:
• Stuck activation or power adjust button on power-up.
• Incorrect waveform frequency or duty cycle.
• Incorrect HV voltage.
• Activation tone failure.
• Corrupted EEPROM calibration data.
• Incorrect LED power display.
• Microprocessor malfunction.
Fail-Safe RF Shutdown:
• Two redundant PA drive shutdowns.
• Two redundant HV shutdowns.
Service mode:
• Tools-only access via internal jumper.
• Mode switch selection of Calibration, diagnostics (Pseudorun) or Last Fault Code recovery.
• Two-point calibration for each Mode from user controls; no trimming potentiometers or selected components.
• Protected EEPROM storage of last calibration settings.

3.3.1 Dual-Channel Architecture

The A1 assembly incorporates two independent microcontrollers for Control (U1) and Monitor (U2). Both
microcontrollers are single-chip Microchip® PIC16C RISC devices, each incorporating program ROM,
RAM, clock oscillator, reset generator and 5-channels of 8-bit analog-to-digital conversion (ADC). Each
microcontroller operates with its own 1K bit serial Electrically Erasable Programmable Read Only Memory
(EEPROM), U3 and U4.
All of the Hyfrecator® 2000's normal functionality is provided by the Control microcontroller. The Monitor
microcontroller serves only as a "watchdog", searching for combinations of signals appearing in the control
channel which are indicative of potentially hazardous faults. Except during Power On Self Test (POST) and
upon detection of a fault, the Monitor microcontroller's function is transparent to the Control
microcontroller. The only normal user function provided by the Monitor microcontroller is illumination of
the Active LED.
The two microcontrollers and their associated hardware are well isolated from one another, such that no
single component failure occurring during a procedure can allow a hazard to persist for over 1/2 second. For
example, each microcontroller has its own +5V regulator, each supplied from different sources. Input
signals provided to both microcontrollers are resistively isolated to prevent a shorted input pin on one
microcontroller from corrupting the signal read by the other.
This dual-channel architecture and fault detection process has successfully passed IEC 60601-1-4 Functional
Safety testing and virtually guarantees that no patient or staff injury can result from a single system
component failure.
12