Datex-Ohmeda Aestiva 7900 SmartVent Technical Reference Manual page 31

Program memory
Safety Relevant Computing
Watchdog systems
1006-0453-000 05/04
Flash memory
Two 512K x 8 Flash memory devices are used. This memory contains the real
time operating system (RTOS) and software code. The Flash memory devices
are socketed.
System RAM
This memory consists of two 128 K x 16 CMOS static RAMs with on-board
expansion capability to 512K x 16 SRAMs.
Non-volatile memory
This memory consists of a single 2K x 8 EEPROM and stores information which
needs to be retained when the system is powered down. This includes user
selectable operating parameters and a system error log.
This section addresses the Safety Relevant Computing (SRC) requirements of
DIN V VDE 801. The electronic hardware design provides the necessary
(SRC)
capability for meeting these requirements. This includes:
• Digital monitoring of selected control signals.
• Analog monitoring of supply voltages, internal control voltages, feedback
signals from the flow and inlet valves, and battery voltage.
• Automatic switch-over to battery operation in the event of an interruption in
ac power.
• Use of the software watchdog timer in the 68340 processor for temporal
monitoring, with direct de-energizing of the flow and inlet valves in the event
of a non-recoverable error.
• Use of an operating mode watchdog for logic and timing monitoring, with
direct de-energizing of the flow and inlet valves in the event of a non-
recoverable error.
• Monitoring of the system clock to detect an operating frequency out of an
acceptable range.
• Use of a redundant high pressure limit safety switch in the bellows drive
circuit which directly de-energizes the flow valve.
MC68340 software watchdog timer
Each mode of ventilator operation has a unique watchdog toggle channel that
is initialized at the legal program entry for that mode. The watchdog is then
toggled by writing that channel number to the watchdog check address during
any program paths that occur only in the selected mode of operation. An error
is detected if program flow is disrupted and an illegal sequence tries to toggle
the watchdog with its own different channel number. Each mode includes
multiple accesses to its watchdog channel number to improve detection of
incorrect program flow.
Watchdog operation
The channel number must be the same for both watchdog initialization and
toggle channel number. A difference is detected as errant program execution
and causes an immediate level 7 interrupt (IRQ7).
A legal watchdog toggle must occur at least once every 35 msec to prevent a
time-out and subsequent level 7 interrupts.
2 Theory of Operation
2-15