Safety critical electronic equipment locks

Abstract

Presented herein are techniques for electronically locking an electronic device in response to detecting a safety-critical fault. As used herein, a "safety-critical fault" is a fault that could cause harm to an individual using the device. In particular, an electronic device according to certain embodiments presented herein is configured to determine when the electronic device has experienced a safety-critical fault. In response, the electronic device automatically restarts itself, and after the restart, is automatically forced into a locked mode. The locked mode prevents the execution of runtime programs stored in the electronic device.

Description

Technical Field

[0001] The present invention generally relates to techniques for electronically locking a device in response to a safety-critical fault. Background Art

[0002] Individuals use a variety of electronic devices every day, such as televisions, computers, mobile computing devices, etc. A subset of individuals use a specific type of electronic device called a medical device. A medical device is an electronic device that performs one or more medical functions. For example, in recent decades, medical prostheses / devices having one or more implantable components (collectively referred to herein as implantable medical prostheses) have provided a wide range of therapeutic benefits to device recipients (i.e., individuals implanted with the components). In particular, partially implanted medical prostheses or fully implanted medical prostheses such as hearing prostheses (e.g., bone conduction devices, mechanical stimulators, cochlear implants, etc.), implantable pacemakers, defibrillators, functional electrical stimulation devices, and other implantable medical devices have been successful for many years in performing life-saving and / or lifestyle-improving functions.

[0003] Over the years, the types of implantable medical prostheses and the range of functions performed thereby have increased. For example, many implantable medical prostheses now typically include one or more instruments, devices, sensors, processors, controllers, or other functional mechanical or electrical components that are permanently or temporarily implanted in the recipient's body. These functional devices are typically used to diagnose, prevent, monitor, treat, or manage disease / injury or symptoms thereof, or to study, replace, or modify anatomical structures or physiological processes. Many of these functional devices utilize power and / or data received from external devices that are part of or operate in conjunction with the implantable medical prosthesis. Summary of the invention

[0004] In one aspect, a method is provided. The method includes: determining, using an implantable component of a medical device, that the implantable component has experienced a safety-critical fault; and automatically restarting the implantable component; and after restarting the implantable component, automatically forcing the implantable component into a lockout mode, wherein the lockout mode prevents execution of a runtime program stored in the implantable component.

[0005] In another aspect, an electronic device is provided. The electronic device includes a non-volatile memory (NVM) configured to store a runtime program; and at least one processor configured to execute the runtime program, wherein executing the runtime program detects a safety-critical fault in the operation of the electronic device and intentionally corrupts the NVM; restarting the electronic device and initiating a lock mode, wherein the lock mode includes verifying the NVM of the device; determining that the NVM is damaged; and in response to determining that the NVM is damaged, preventing the runtime program from being re-executed.

[0006] In another aspect, one or more non-transitory computer-readable storage media are provided, which are encoded with instructions. When the one or more non-transitory computer-readable storage media are executed by a processor, the instructions cause the processor to: determine that the electronic device has experienced a safety-critical fault using data from an integrated diagnostic mechanism of the electronic device; automatically restart the electronic device; determine whether a non-volatile memory (NVM) of the electronic device is damaged; and in response to determining that the NVM is damaged, indefinitely execute code stored in a read-only memory (ROM) of the electronic device. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Various embodiments of the present invention are described herein with reference to the accompanying drawings, wherein

[0008] Figure 1 is a block diagram illustrating a cochlear implant according to certain embodiments presented herein;

[0009] Figure 2 is a schematic block diagram of a processing unit according to certain embodiments presented herein;

[0010] Figure 3 is a detailed flow chart of a method according to certain embodiments presented herein;

[0011] Figure 4 is a diagram illustrating a method of performing a Figure 3 A timeline of the order in which certain operations are performed in a method;

[0012] Figure 5 is a schematic block diagram illustrating a spinal cord stimulator according to certain embodiments presented herein; and

[0013] Figure 6 is a flow chart of a method according to certain embodiments presented herein. DETAILED DESCRIPTION

[0014] Presented herein are techniques for electronically locking an electronic device in response to detecting a safety-critical fault. As used herein, a "safety-critical fault" is a fault that could cause harm to an individual using the device. In particular, an electronic device according to certain embodiments presented herein is configured to determine when the electronic device has experienced a safety-critical fault. In response, the electronic device automatically restarts itself, and after the restart, is automatically forced into a locked mode. The locked mode prevents the execution of runtime programs stored in the electronic device.

[0015] For ease of description only, the techniques presented herein are described primarily with reference to one illustrative electronic device, namely, an implantable medical prosthesis known as a cochlear implant. However, it should be appreciated that the techniques presented herein may also be used with a variety of other electronic devices that may be subject to safety-critical failures, such as implantable components of medical prostheses that provide a wide range of therapeutic benefits to recipients. For example, it should be appreciated that the technology presented herein can be used with hearing prostheses other than cochlear implants, including acoustic hearing aids, auditory brainstem stimulators, bone conduction devices, middle ear hearing prostheses, direct acoustic stimulators, bimodal hearing prostheses, bilateral hearing prostheses, etc., as well as other implantable components such as implantable pacemakers, spinal cord stimulators, deep brain stimulators, motor cortex stimulators, sacral nerve stimulators, pudendal nerve stimulators, vagus nerve stimulators, trigeminal nerve stimulators, retinal or other visual prostheses / stimulators, occipital cortex implants, diaphragm (septal) pacemakers, analgesic stimulators, other nerve or neuromuscular stimulators, etc.

[0016] Figure 1 1 is a schematic diagram of an exemplary cochlear implant 100 that is configured to implement various aspects of the technology presented herein. Cochlear implant 100 includes an external component 102 and an internal component / implantable component (implant) 104. External component 102 is configured to be attached directly or indirectly to the body of a recipient and typically includes an external coil 106 and typically includes a magnet ( Figure 1 The external component 102 further includes a sound processing unit 112 .

[0017] The sound processing unit 112 includes one or more sound input devices for receiving sound signals. Figure 1 One example sound input device is illustrated, namely microphone 108. However, it should be appreciated that additional microphones and additional types of sound input devices (e.g., telecoil, etc.) may also be included in sound processing unit 112. Sound processing unit 112 also includes sound processor 109 and radio frequency (RF) transceiver 110.

[0018] The implantable component 104 includes an implant body (main module) 114, a lead region 116, and an intracochlear stimulation assembly 118, all of which are configured to be implanted beneath the recipient's skin / tissue (tissue) 105. The implant body 114 typically includes a hermetically sealed housing 115 in which an RF interface circuit 124, an implant processing unit 125, a battery 129, and a stimulator unit 130 are disposed. The implant body 114 also includes an internal coil / implantable coil 122, which is typically external to the housing 115 but is connected to the stimulator via a hermetic feedthrough ( Figure 1) is connected to the RF interface circuit 124.

[0019] As noted, stimulation assembly 118 is configured to be at least partially implanted in the recipient's cochlea ( Figure 1 The stimulation assembly 118 includes a plurality of longitudinally spaced intracochlear electrical stimulation contacts (electrodes) 126 that together form a contact or electrode array 128 for delivering electrical stimulation (electrical current) to the recipient's cochlea. The stimulation assembly 118 extends through an opening in the recipient's cochlea (e.g., cochleostomy, round window, etc.) and has a lead region 116 and an airtight feedthrough ( Figure 1 The lead region 116 includes a plurality of conductors (wires) that electrically couple the electrode 126 to the stimulator unit 120.

[0020] As noted, the cochlear implant 100 includes an external coil 106 and an implantable coil 122. The coils 106 and 122 are typically wire antenna coils each comprised of multiple turns of electrically insulated single or multiple strands of platinum or gold wire. Typically, a magnet is secured relative to each of the external coil 106 and the implantable coil 122. The magnets secured relative to the external coil 106 and the implantable coil 122 facilitate operational alignment of the external coil with the implantable coil. This operational alignment of the coils 106 and 122 enables the external component 102 to transmit data, and possibly power, to the implantable component 104 via a tightly coupled wireless link 123 formed between the external coil 106 and the implantable coil 122. In some examples, the tightly coupled wireless link 123 is a radio frequency (RF) link. However, various other types of energy transfer, such as infrared (IR) transmission, electromagnetic transmission, capacitive transmission, and inductive transmission, may be used to transfer power and / or data from the external component to the implantable component, such that, Figure 1 Only one example arrangement is illustrated.

[0021] As noted above, the sound processing unit 112 includes a sound processor 133 that is configured to convert an input audio signal into a stimulation control signal for stimulating a first ear of the recipient (i.e., the sound processor 133 is configured to perform sound processing on the input audio signal received at the sound processing unit 112. In other words, the sound processor 133 (e.g., one or more processing elements implementing firmware, software, etc.) is configured to convert a captured input audio signal into a stimulation control signal representing electrical stimulation for delivery to the recipient.

[0022] exist Figure 1In an embodiment of the present invention, the stimulation control signal generated by the sound processor 109 is provided to the RF transceiver 110, which transmits the stimulation control signal (e.g., in an encoded manner) transcutaneously to the implantable component 104 via the external coil 106 and the implantable coil 122. That is, the stimulation control signal is received at the RF interface circuit 124 via the implantable coil 122 and provided to the stimulator unit 120. The stimulator unit 120 is configured to utilize the stimulation control signal to generate an electrical stimulation signal (e.g., a current signal) for delivery to the recipient's cochlea via one or more stimulation contacts 126. In this way, the cochlear implant 100 electrically stimulates the recipient's auditory nerve cells, thereby bypassing the missing or defective auditory hair cells that normally convert acoustic vibrations into neural activity in a manner that causes the recipient to perceive one or more components of the input audio signal.

[0023] As noted above, implantable component 104 also includes implant processing unit 125. In general, implant processing unit 125 is configured to initiate and control the operation of implantable component 104. Additionally, implantable component 104 is configured to implement a diagnostic safety mechanism for the implantable component and, as described below, electronically "lock out" the implantable component when a safety-critical fault is detected.

[0024] More specifically, the implant processing unit 125 implements one or more diagnostic safety mechanisms that are activated while the recipient is using the implantable component. These diagnostic safety mechanisms can be configured to, for example, monitor for short circuit conditions at the implant electronics and / or electrode array 128, monitor the battery 129 (e.g., monitor to determine if a maximum battery voltage threshold has been reached / exceeded, monitor for battery overcharge conditions, etc.), monitor for faults in the voltage measurement system, monitor for leakage to tissue, monitor for memory hard errors, etc.

[0025] According to certain embodiments presented herein, when these diagnostic safety mechanisms of the implant processing unit 125 detect a fault in the operation of the implantable component 104, the implant processing unit 125 is configured to perform a reset of the implantable component to ensure that the implantable component immediately stops operating and is placed in a safe state (i.e., a state in which any potential risk / hazard to the recipient is remedied). The reset of the implantable component can be achieved in several different ways. In one example, the reset disconnects all electrodes from the tissue, stops / terminates all processing, and disconnects the internal battery 129 from another internal circuit system (thereby deenergizing the implant if no external power is supplied).

[0026] After the reset, the implant processing unit 125 restarts operation and determines the reason for the reset. If the implant processing unit 125 determines that the reason for the reset is a "safety critical fault" (i.e., a fault / condition that creates a potential risk situation for the recipient), the implant processing unit 125 is configured to initiate another reset and cause the implantable component to enter an electronic "lock mode" in which only basic non-risk functions are supported. This functionality may include, for example, the ability to allow interrogation of the internal memory of the implantable component and unlocking the implantable component. This unlocking is only allowed in, for example, a clinic after a trained clinician or engineer has assessed the risks associated with the fault that triggered the safety check. Reference is made below to Figure 2 and Figure 3 Further details regarding electronic locking of implantable component 104 are described further.

[0027] More specifically, Figure 2 It's a picture. Figure 1 A functional diagram of one embodiment of an implant processing unit 125, and Figure 3 is a detailed flow chart illustrating a method 160 for operating an implant processing unit 125 according to certain embodiments herein.

[0028] First, refer to Figure 2 , implant processing unit 125 includes read-only memory (ROM) 150, program memory / random access memory (RAM) 152, non-volatile memory (NVM) 154, and at least one processor (e.g., microprocessor, microcontroller, etc.) 156. ROM 150 includes code 151, which is sometimes referred to herein as ROM code or boot code (e.g., hardwired into the ASIC). NVM 154 includes a runtime program 159, an implant lock memory block 157, and a fault information memory block 158.

[0029] Next reference Figure 3 , method 160 begins at 162, where implantable component 104 is started or restarted (i.e., powered on / up). For example, in response to a command received from sound processing unit 112 or another external device (e.g., in response to a button press at the external device, in response to detecting the presence / proximity of the external device relative to the implantable component, etc.), implantable component 104 may be powered on. At 164, in response to implantable component 104 being powered on, ROM code 151 in ROM 150 is executed by at least one processor 156. The execution of ROM code 151 by at least one processor 156 is referred to herein as a "ROM mode" of implantable component 156.

[0030] When executed by at least one processor 156, ROM code 151 is configured to, among other operations, perform validation of NVM 154. That is, at 168, ROM code 151 is configured to determine whether the NVM is valid or damaged (e.g., including any damaged memory blocks). For example, ROM code 151 may be configured to perform a cyclic redundancy check (CRC) check on NVM 154.

[0031] If at 168, ROM code 151 determines that NVM 154 is invalid / damaged (ie, includes one or more damaged memory blocks), implantable component 104 remains in ROM mode indefinitely, as indicated by arrow 165. This will be described further below.

[0032] If at 168, ROM code 151 is able to successfully authenticate NVM 154, then at 170, runtime program 159 is loaded from NVM 154 into program memory 152 and executed by at least one processor 156. Figure 2 This is indicated by arrow 155 .

[0033] As used herein, runtime program 159 refers to a collection of codes, instructions, etc., which, when executed by at least one processor 156, enables implantable component 104 to perform its intended operating functions. In the particular case of implantable component 104, these intended operating functions include, among other operations, receiving stimulation commands from sound processing unit 112 and delivering electrical stimulation signals to a recipient via electrodes 126. Thus, if NVM 154 is not damaged, implantable component 104 exits ROM mode and enters a "runtime mode" or "runtime state."

[0034] When the runtime program 159 is loaded and first executed by at least one processor 156, at 172, it is determined whether the implantable component 104 is powered on due to a reset in response to a safety-critical fault. This determination can be made by checking the transient reset registers 153. These transient reset registers 152 are part of the diagnostic safety mechanism or are used by the diagnostic safety mechanism (running as part of the runtime program 159) to immediately store information associated with the detected fault. These transient reset registers 153 are not reset / erased in response to the reset of the implantable component. As such, these transient reset registers 153 can be interrogated by the runtime program 159 at 172 to determine the cause of the fault, and thus the cause of the reset. However, these transient reset registers 153 cannot be read by external devices and are continuously updated with various information so that any information stored therein is cleared within a certain period of time.

[0035] This determination is made by the initial / preliminary code (i.e., the first few lines of code) of the runtime program 159, and is itself one of the first operations performed by the implantable component in the runtime mode. More specifically, this determination can be made before the recipient is exposed to any potential risk conditions, such as before stimulation is delivered to the recipient. Additionally, this determination can be made before the battery is connected, before battery voltage or current measurements are performed, and before the microphone is enabled.

[0036] In the case where implantable component 104 powers up normally (e.g., in response to instructions / commands received from sound processing unit 112), then implantable component 104 determines that the restart (or start in the earliest instance) was not due to a reset, and the method proceeds to 174. Additionally, in some cases, implantable component 104 may determine that the implantable component powered up after a reset, but that the reset was due to a so-called "unclassified fault" or "non-safety critical fault" determined from transient reset register 153. Again, in this case, the method proceeds to 174 (i.e., a fault of unknown origin).

[0037] At 174, implantable component 104 operates in runtime mode (i.e., providing full functionality of the implantable component) until a fault is detected at 176 or the implantable component is powered off via normal procedures ( Figure 3 If a fault is detected at 176, the implantable component 182 is reset substantially immediately at 182 to place the implantable component in a safe state in which any potential risk / hazard to the recipient is remedied. Further details regarding fault detection are described further below.

[0038] As noted above, the implantable component is reset at 182 substantially immediately after the fault is detected at 176. In particular, at this stage, information about the fault is not stored in the fault information memory block 158 (i.e., the fault incurred is an unclassified fault). One reason for resetting the implantable component at 182 substantially immediately after the fault is detected at 176 is to avoid any unnecessary processing when the implantable component is potentially in an unsafe state.

[0039] After resetting the implantable component, method 160 returns to 164. That is, the reset causes the implantable component to restart in ROM mode. As noted, while in ROM mode, implantable component 104 is configured to determine whether the NVM is valid or corrupted (e.g., perform a CRC check on NVM 154). At this point, since the fault that caused the last reset was an unclassified fault, implantable component 104 has not yet performed any operations to change the validity of NVM 154. As such, the method proceeds to 170, where runtime program 159 is loaded from NVM 154 into program memory 152 and executed by at least one processor 156. Again, this is done in Figure 2 This is indicated by arrow 155 .

[0040] As noted above, when runtime program 159 is loaded and first executed by at least one processor 156, at 172, it is determined whether implantable component 104 is powered on due to a reset in response to a safety-critical fault. This determination may again be made by checking transient reset register 153.

[0041] As noted, the determination at 172 is made by the initial / preliminary code (i.e., the first few lines of code) of the runtime program 159 and is itself one of the first operations performed by the implantable component in runtime mode (i.e., before the recipient is exposed to any potentially risky condition, such as before stimulation is delivered to the recipient).

[0042] If, at 172, implantable component 102 is reset due to a non-safety-critical fault, then, at 174, implantable component 104 operates in a runtime mode until another fault is detected at 176 or the implantable component is powered off via normal procedures. However, if, at 172, it is determined that the fault suffered by implantable component 104 is a safety-critical fault, then, at 178, implantable component 104 stores information about the fault (e.g., information about the origin, cause, and / or type of the fault) in a fault information memory block 158 of NVM 154. Additionally, at 180, implantable component 104 intentionally damages implant lockout memory block 157. That is, implant lockout memory block 157 is a dedicated memory block added to NVM 154 for the purpose of being damaged when a safety-critical fault of implantable component 104 is detected. As further described below, damaging implant lockout memory block 157 in NVM 154 damages / invalidates NVM 154.

[0043] After information regarding the cause of the fault has been stored in fault information memory block 158 (at 178) and implant lock memory block 157 has been corrupted (at 180), then implantable component 182 is reset at 182. One reason the operations of 178 and 180 may be performed at this time is that the safety critical fault 172 is detected at the beginning of runtime mode (i.e., before full functionality is enabled). As such, additional processing at this time does not present a risk to the recipient.

[0044] After resetting the implantable component at 180, method 160 again returns to 164 (i.e., the implantable component restarts in ROM mode again). As noted, while in ROM mode, implantable component 104 is configured to determine at 168 whether NVM 154 is valid or damaged (e.g., perform a CRC check on NVM 154). At this point, since the fault that caused the last reset has previously been determined to be a safety-critical fault, implantable component 104 performs operations at 180 to intentionally damage implant locked memory block 157. Therefore, in this situation, ROM code 151 determines at 168 that NVM 154 is invalid / damaged (i.e., includes a damaged implant locked memory block 157). Therefore, as shown by arrow 165, implantable component 104 remains in ROM mode indefinitely.

[0045] At 166, the implantable component 104 remains in ROM mode until the implantable component 104 is definitely unlocked. The implantable component 104 can be unlocked, for example, via a command received from an external device such as a computing device or an adaptation system used by a clinician. In other words, if the NVM 154 is damaged (i.e., one or more memory blocks included therein are damaged), the implantable component 104 will not and cannot exit the ROM mode without receiving a command from an external device. The implantable component 104 remaining in ROM mode is sometimes referred to as the "locked mode" or "locked state" of the implantable component 104. When the implantable component 104 is in this locked mode, the implantable component can only perform limited functions. These limited functions can include: only limited read and write functions are allowed from the auxiliary device to the NVM 154 of the implantable component 104 (i.e., enabling inquiries to the implantable component, thereby allowing the clinician or other individual to determine what condition causes the lock), thereby allowing the clinician or other individual to unlock the implant, and allowing the clinician or other individual to reprogram the NVM 154 with new firmware.

[0046] Figure 4 It is illustrated in Figure 3 A unit-less timeline 183 of the order of operations performed in the above example. Figure 4Timeline 183 of FIG. 1 begins at 174 where implantable component 104 is operating normally in runtime mode (ie, not following a fault-triggered reset).

[0047] As noted above, when a safety-critical fault is detected, the implantable component 104 is electronically locked to ensure that the implantable component will not and cannot continue to operate in the event of the fault. The electronic locking mechanism described herein can, for example, prevent more serious consequences from the fault and ensure that the recipient goes to a clinic where the condition that caused the lockout can be properly evaluated and decisions can be made regarding future use of the implant. As noted above, a safety-critical fault is a fault that could cause harm to the individual using the device (i.e., in the case of an implantable component, the recipient).

[0048] As noted above, a device (such as an implantable component 104) configured to implement the techniques presented herein is also configured to implement one or more diagnostic safety mechanisms, which are activated when an individual is using the device. These diagnostic safety mechanisms are configured to detect the occurrence of faults and store information about these faults when appropriate. In the specific case of an implantable component, an example of a safety-critical fault that can be detected by these diagnostic safety mechanisms may be a short circuit condition of an implant electronic device and / or an implantable electrode array (e.g., determined by checking the battery discharge current). Another example of a safety-critical fault that can be detected by these diagnostic safety mechanisms is a condition in which the voltage of an implantable battery has reached or exceeded a maximum battery voltage threshold (e.g., determined by directly measuring the battery voltage and / or measuring the battery charging current). Another example of a safety-critical fault that can be detected by these diagnostic safety mechanisms is a condition in which an implantable battery has been overcharged (i.e., a battery overcharge condition, which is determined by measuring the battery voltage and / or measuring the battery charging current). Another example of a safety-critical fault that can be detected by these diagnostic safety mechanisms is a condition in which an implantable component's voltage measurement system has an error (e.g., determined by checking whether a voltage that cannot exist in the system can be measured). Yet another example of a safety-critical fault that may be detected by these diagnostic safety mechanisms is a condition in which there is leakage to the recipient's tissue (e.g., determined by checking whether electrodes in the tissue are pulled to an uncontrolled potential). Another example of a safety-critical fault that may be detected by these diagnostic safety mechanisms is a condition in which the memory of an implantable component has experienced a hard fault / error (e.g., determined by periodically reading back blocks in program memory after they have been loaded from the NVM and performing a CRC on the read-back blocks of program memory). It should be appreciated that the safety-critical faults described above are illustrations of types of safety-critical faults and do not represent an exhaustive list of safety-critical faults that may be detected according to the embodiments presented herein. In practice, different devices may have different types of faults in total that may be considered safety-critical, resulting in an electronic locking device.

[0049] Various embodiments presented herein have been described primarily with reference to a cochlear implant, and in particular, have been described with reference to an example arrangement of a cochlear implant configured to implement the presented techniques. Figures 1 to 4The present invention is generally described. However, as noted elsewhere, the technology presented herein may also or alternatively be used with other types of cochlear implants and other types of electronic devices that may be subject to safety-critical failures, such as implantable components of medical prostheses that provide a wide range of therapeutic benefits to recipients. For example, it should be appreciated that the technology presented herein may be used with hearing prostheses other than cochlear implants, including acoustic hearing aids, auditory brainstem stimulators, bone conduction devices, middle ear hearing prostheses, direct acoustic stimulators, bimodal hearing prostheses, bilateral hearing prostheses, etc., other implantable components such as implantable pacemakers, spinal cord stimulators, deep brain stimulators, motor cortex stimulators, sacral nerve stimulators, pudendal nerve stimulators, vagus nerve stimulators, trigeminal nerve stimulators, retinal or other visual prostheses / stimulators, occipital cortex implants, diaphragm (septum) pacemakers, analgesic stimulators, other nerves or neuromuscular stimulators, etc.

[0050] For example, Figure 5 is a simplified schematic diagram illustrating a spinal cord stimulator 500 in which certain embodiments presented herein may be implemented.

[0051] More specifically, the spinal cord stimulator 500 includes a stimulation assembly 518 implanted beneath the skin / tissue (tissue) of a recipient and an implant body (main module) 514. The implant body 514 generally includes a hermetically sealed housing 515 in which an implant processing unit 525, a battery 529, and a stimulator unit 530 are disposed. The implant body 514 also includes a communication mechanism 524 for communicating within an external device. The communication mechanism 524 may include, for example, a wireless transceiver, an internal / implantable coil, and an RF interface circuit, among others.

[0052] The stimulation assembly 518 is implanted within the recipient adjacent to / proximate to the recipient's spinal cord 527 and includes five (5) stimulation electrodes 526, referred to as stimulation electrodes 526(1) to 526(5). The stimulation electrodes 526(1) to 526(5) are disposed within an electrical insulator 584 and are electrically connected to a stimulator 530 via conductors (not shown) extending through the electrical insulator 584.

[0053] After implantation, implant processing unit 525 is configured to generate stimulation signals for delivery to spinal cord 527 via stimulation electrodes 526(1) to 526(5). Figure 5 Not shown, but an external controller may also be provided to transmit signals through the recipient's skin / tissue to the implant processing unit 525 to control the stimulation signals.

[0054] Similar to the embodiments described above, the implant processing unit 525 is configured to implement one or more diagnostic safety mechanisms that are activated while the recipient is using the implantable component. These diagnostic safety mechanisms can be configured to, for example, monitor for short circuit conditions at the implant electronics and / or electrode array 528, monitor the battery 529 (e.g., monitor to determine if a maximum battery voltage threshold has been reached / exceeded, monitor for battery overcharge conditions, etc.), monitor for faults in the voltage measurement system, monitor for leakage to tissue, monitor for memory hard errors, etc.

[0055] According to certain embodiments presented herein, when these diagnostic safety mechanisms of the implant processing unit 525 detect a fault in the operation of the spinal cord stimulator 500, the implant processing unit 125 is configured to perform a reset of the spinal cord stimulator 500 to ensure that the spinal cord stimulator immediately ceases operation and is placed in a safe state (i.e., a state in which any potential risk / hazard to the recipient is remedied). The reset of the spinal cord stimulator 500 can be achieved in several different ways. In one example, the reset disconnects all electrodes from the tissue, stops / terminates all processing, and disconnects the internal battery 529 from other internal circuits (or powers off the implant if no external power is supplied).

[0056] After the reset, the implant processing unit 525 restarts operation and determines the reason for the reset. If the implant processing unit 525 determines that the reason for the reset is a "safety critical fault" (i.e., a fault / condition that creates a potential risk situation to the recipient), the implant processing unit 525 is configured to initiate another reset and cause the implantable component to enter an electronic "lock mode" in which only basic non-risk functionality is supported. This functionality may include, for example, allowing interrogation of the internal memory of the implantable component and the ability to unlock the implantable component. Unlocking may only be allowed in a clinic, for example, after a trained clinician or engineer has assessed the risks associated with the fault that triggered the safety check. Further details regarding the electronic lockout of implantable components such as the spinal cord stimulator 500 have been referenced below. Figure 2 and Figure 3 In other words, the implant processing unit 525 can be configured to be similar to the above reference Figure 2 and Figure 3 The described implant handling unit 125 operates in a similar manner.

[0057] Figure 6690 is a flow chart of a method 690 according to embodiments presented herein. The method 690 begins at 691, where an implantable component of a medical device determines that the implantable component has experienced a safety-critical fault. At 692, the implantable component automatically restarts the implantable component. At 694, after restarting the implantable component, the implantable component is forced into a lockout mode, where the lockout mode prevents execution of runtime programs stored in the implantable component.

[0058] As detailed above, techniques are presented herein for implementing an electronic "lockout mode" within an electronic device, such as in an implantable medical component (implantable component). In particular, the techniques presented herein configure the implantable component so that if a fault of a serious nature (i.e., a safety-critical fault) is detected, the implantable component immediately ceases normal operation and transitions to a lockout mode (e.g., which may include disconnecting all electrodes from the device, stopping all processing, and disconnecting the internal battery from the internal circuitry) with minimal operation. The recipient can then, for example, go to a clinic for diagnosis of the problem.

[0059] It should be appreciated that the embodiments described above are not mutually exclusive and that the various embodiments may be combined in various ways and arrangements.

[0060] Since the specific preferred embodiments disclosed herein are intended to be used as an illustration and not a limitation of several aspects of the present invention, the scope of the invention described and claimed herein is not limited by these embodiments. Any equivalent embodiments are intended to be within the scope of the present invention. In fact, according to the foregoing description, in addition to those embodiments shown and described herein, various modifications of the present invention will become apparent to those skilled in the art. Such modifications are also intended to fall within the scope of the appended claims.

Claims

1. A method for electronically locking a medical device, comprising: determining, by a runtime program stored in a non-volatile memory NVM of an implantable component of the medical device, that a previous reset of the implantable component was due to a safety-critical fault; automatically restarting the implantable component; as well as automatically forcing the implantable component into a locked mode after restarting the implantable component, Wherein the locked mode prevents execution of the runtime program stored in the implantable component.

2. The method of claim 1, wherein the locked mode allows only limited read and write functionality from an auxiliary device to the memory of the implantable component.

3. The method of claim 1 , wherein automatically forcing the implantable component into the locked mode comprises: restarting the implantable component so that the implantable component executes code stored in a read-only memory ROM of the implantable component, wherein executing the code stored in the ROM checks the non-volatile memory NVM of the implantable component for damaged memory blocks; determining that a memory block in the NVM is damaged; as well as In response to determining that the memory block in the NVM is damaged, the code stored in the ROM is executed indefinitely.

4. The method of claim 3, wherein determining that the memory block in the NVM is damaged comprises: A cyclic redundancy check (CRC) check is performed on the NVM.

5. The method of claim 1 , wherein prior to determining that the implantable component has experienced the safety-critical failure, the method comprises: determining that the implantable component has experienced an unclassified failure; restarting the implantable component so that the implantable component executes code stored in a read-only memory ROM of the implantable component, wherein executing the code stored in the ROM checks the non-volatile memory NVM of the implantable component for damaged memory blocks; executing said code stored in said ROM without detecting any damaged memory blocks; loading the runtime program into a program memory for execution; as well as After executing the runtime program, the unclassified fault is determined to be a safety-critical fault.

6. The method of claim 5, wherein in response to determining that the unclassified fault is a safety-critical fault, the method comprises: storing an indication of the safety-critical fault in the NVM; as well as Prior to automatically restarting the implantable component, a dedicated memory block in the NVM is corrupted.

7. The method of claim 1 , wherein detecting a safety-critical fault comprises: A short circuit condition in the implantable component is detected.

8. The method of claim 1 , wherein the implantable component comprises an implantable battery, and wherein detecting a safety-critical fault comprises: Detecting that the voltage of the implantable battery has reached a maximum voltage threshold, or detecting that the implantable battery has been overcharged.

9. An electronic device, comprising: a non-volatile memory NVM configured to store a runtime program; as well as At least one processor configured to: executing the runtime program, wherein the runtime program determines that a previous restart of the implantable component was due to a safety-critical fault and subsequently corrupted the NVM; restarting the electronic device and initiating a lock mode, wherein the lock mode includes verification of the NVM of the device; Determining that the NVM is damaged; as well as In response to determining that the NVM is damaged, re-execution of the runtime program is prevented.

10. The electronic device of claim 9, wherein the lock mode allows only limited read and write functions from a secondary device to the NVM.

11. The electronic device of claim 9, wherein to authenticate the NVM of the device, the processor is configured to perform a cyclic redundancy check (CRC) check on the NVM.

12. The electronic device of claim 9, wherein before determining that the electronic device has experienced the safety-critical fault, the processor is configured to: determining that the electronic device has experienced an unclassified fault; In response to determining that the electronic device has experienced the unclassified fault, restarting the electronic device and executing code stored in a read-only memory ROM of the electronic device; verifying the NVM; After successfully verifying the NVM, loading the runtime program into a program memory for execution; as well as After executing the runtime program, the unclassified fault is determined to be a safety-critical fault.

13. The electronic device of claim 12, wherein in response to determining that the unclassified fault is a safety-critical fault, the processor is configured to: storing an indication of the safety-critical fault in the NVM; and Prior to restarting the electronic device, a dedicated memory block in the NVM is destroyed.

14. The electronic device according to claim 9, wherein in order to prevent the runtime program from being re-executed, the processor continuously executes codes stored in a read-only memory ROM of the electronic device.

15. The electronic device of claim 9, wherein the electronic device is an implantable component of a medical device, and wherein the NVM and the at least one processor are configured to be implanted within a recipient of the implantable component.

16. One or more non-transitory computer-readable storage media encoded with instructions that, when executed by a processor, cause the processor to: executing a runtime program stored in the non-volatile memory NVM to determine, using data from an integrated diagnostic mechanism of the electronic device, that a previous reset of the electronic device was due to a safety-critical fault; automatically restarting the electronic device; determining whether a non-volatile memory NVM of the electronic device is damaged; and In response to determining that the NVM is damaged, the code stored in the read-only memory ROM of the electronic device is executed indefinitely.

17. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to infinitely execute the code stored in the ROM of the electronic device include instructions that cause the processor to: Preventing execution of a runtime program stored in the NVM of the electronic device.

18. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to infinitely execute the code stored in the ROM of the electronic device include instructions that cause the processor to: Only limited read and write functionality is allowed from an auxiliary device to the NVM of the electronic device.

19. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to determine whether the NVM of the electronic device is damaged include instructions that cause the processor to: A cyclic redundancy check (CRC) check is performed on the NVM.

20. The non-transitory computer-readable storage medium of claim 16, further comprising instructions that, prior to determining that the electronic device has experienced the safety-critical fault, cause the processor to: determining that the electronic device has experienced an unclassified fault; In response to determining that the electronic device has experienced the unclassified fault, restarting the electronic device in a mode in which the processor executes the code stored in the ROM, wherein the code stored in the ROM checks the NVM for damaged memory blocks; executing said code stored in said ROM without detecting any damaged memory blocks; loading the runtime program into program memory for execution; as well as After executing the runtime program, the unclassified fault is determined to be a safety-critical fault.

21. The non-transitory computer readable storage medium of claim 20, further comprising instructions that, in response to determining that the unclassified fault is a safety-critical fault, cause the processor to: storing an indication of the safety-critical fault in the NVM; and Prior to automatically restarting the electronic device, a dedicated memory block in the NVM is corrupted.

22. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to determine that the electronic device has experienced a safety-critical fault include instructions that cause the processor to: A short circuit condition is detected in the electronic device.

23. The non-transitory computer-readable storage medium of claim 16, wherein the electronic device is an implantable component, the implantable component comprising an implantable battery, and wherein the instructions that cause the processor to determine that the electronic device has experienced a safety-critical fault comprise instructions that cause the processor to: Detecting that the voltage of the implantable battery has reached a maximum voltage threshold, or detecting that the implantable battery has been overcharged.

Images