Operating manual 810353-BALDE-150220
Version 20.02.2015
Page 16 of 36
The software of the power module and the control modules are continually checked
and monitored. For errors there is a shutdown and the error output.
7.3.
Description of the safety feedback
The state of the high-voltage generator is transmitted via the bit "Device is safely off" in
the status word (see in document "Explanation of the status word") of a PDO via CAN
interface. As shown in the illustration, the bit "Device is safety off" corresponds to the
condition of the safety relay. The bit is set if the high-voltage generator is in a new state
and the safety relay is closed. The bit is reset if the high-voltage generator is in an un-
safe condition and thus the safety relay is open.
The safety relay is controlled both by the control module and the power module. Only if
the control signals REL1 and REL2 are simultaneously set are the switches SW1 and
SW2 closed and the safety relay is energized. The control conditions are listed in the
following table.
The plausibility of the safety relay is checked by a monitoring function. If the safety re-
lay cannot be controlled by the control signals, "Safety error" is set in the status word.
The plausibility of the safety relay can also be checked through the bit "OPEN safety
contact" in the control word. The safety relay can only be controlled by this bit, if the
high voltage is not switched on (the bit "High voltage ON" equals 0). The state of the
safety relay can be determined by the bit "Safety contact OPEN" in status word. If the
safety relay functions correctly, the bit "Safety contact OPEN" must equal the bit
"OPEN safety contact".
