D2 PHASER User Manual
DOC-M88-EXX141 V5 – 01.2015 23
undercurrent, arc … (etc.) (as a result of the generators self diagnosis) breaks SL1 using the forcibly
guided relay K1. There are two voltage dividers inside the generator (HV-Monitor-A/B). The safety
controller checks both of these HV divider values simultaneously and breaks SL1 by relay K1 if one of
them indicates overvoltage (>34kV).
Safety line 2
SL2 directly breaks mains supply of the HV generator by forcibly guided relay K2 which opens if a
failure of the HV generator’s internal switch-off circuitry is detected with a short delay after SL1 is
opened. In addition, the voltage divider values and the X-ray-on signal coming from the generator
switch off SL2 if they do not fit together.
X-ray warning displays
There are two internal X-ray warning displays which display the status 'X-ray ON'. The electrical
current through the displays is checked by the safety microcontroller which breaks SL1 in case of an
error. Additionally an optional external warning display can be connected to the instrument. It is
controlled through safety relay K3 and checked by the safety microcontroller in the same way as the
internal displays. If it is not attached, a dummy connector simulates a correctly working display. The
dummy connector is situated inside the radiation safety enclosure.
Microcontroller diagnosis during startup
After turning on the system, the following tests are performed in order to verify proper operation of the
safety microcontroller: RAM-test, ROM-test (check sum test) and test of the error memory, watchdog
test and circuit tests (overvoltage detection, HV-on detection, illegal HV detection). Furthermore, the
status of the components of the safety system is read back and verified. If none of the tests detects
any error, then the microcontroller will enter the normal operation mode.
In case of any errors during the startup checks the microcontroller will force open safety relays K1 and
K2 and continue with the error operation mode. If the error memory indicates any old safety errors
which have not been confirmed and reset yet, then the microcontroller will block the X-ray generation
and enter the error operation mode, too.
Note
To make sure that electro-mechanical parts work properly, the software forces the system
to repeat the start-up check periodically (on a monthly basis).
Microcontroller diagnosis during normal operation mode
The status of each component of the safety system is monitored permanently. This includes read back
signals (KeySwitch-Monitor, K1-Monitor, etc.), HV-generator signals (XRay-On-Monitor, HV-Monitor-
A/B, etc.), and analog circuit results (Detected-HV-On, Illegal-HV-On-Monitor, etc.). If all plausibility
checks are true then the microcontroller will activate the two safety relays K1 and K2 and thus enable
the generation of high voltage. The microcontroller and its software routines are supervised by the
following safety precautions: Program flow counter, online ROM-test (check sum test) and two
hardware based external watchdog units which are able to shut down the X-ray generator via relays
K1 and K2.
Microcontroller diagnosis during error operation mode
If the microcontroller detects any error within the X-ray safety system then relay K1 will be disabled
and as a consequence, the high voltage generator will be shut down immediately. Additionally the
microcontroller will disable K2 (mains supply of the HV-generator) if it detects illegal HV, i.e. one of the
following conditions: active HV in spite of disabled Safety Line 1, or active HV in spite of a PS-fault
reported by HV generator, or signals of HV-Monitor-A/B and Xray-On-Monitor not fitting together.
Any detected error will be saved twice, i.e. as both normal and inverted error code, in the error
memory (flash based memory). The error condition is saved in non-volatile memory in order to make
sure that the system stays blocked even after power-off and -on of the instrument. In order to enable
the high voltage generator after an error, the user / service has to confirm the error condition and to
reset the safety system using a special program protected by a password. This program will send a
specific reset command to the microcontroller via the serial interface. After the reset the
To Next Page
Loading...
