System and method for error handling in a surgical robotic system

Abstract

A surgical robotic system includes a control tower including a first controller configured to detect a first error associated with the control tower and having a first error handler configured to generate a first error signal based on the first error. The system includes a console coupled to the control tower and including a display, a user input device configured to generate a user input; and a mobile cart coupled to the control tower and having a second controller configured to detect a second error associated with the mobile cart and a second error handler configured to generate a second error signal based on the second error. The system includes a robotic arm disposed on the mobile cart and including a surgical instrument configured to treat tissue and actuatable in response to the user input; and a third controller configured to detect a third error associated with the surgical robotic arm and having a third error handler configured to generate a third error signal based on the third error.

Description

BACKGROUND

[0001] Surgical robotic systems are currently used in minimally invasive medical procedures. Some surgical robotic systems include a surgical console that controls surgical robotic arms and surgical instruments having end effectors (e.g., clamping or grasping instruments) coupled to and actuated by the robotic arms.

[0002] Each of the components of a surgical robotic system (e.g., the surgical console, the robotic arms, etc.) can be controlled by a computing device, which communicate with each other over a communication network. Thus, when one of the computing devices or components of the surgical robotic system encounters an error, such error needs to be propagated throughout the surgical robotic system and all of its components, as the error can be local or affect other components and / or the entire surgical robotic system. Accordingly, there is a need for an error handler subsystem for use with a surgical robotic system. SUMMARY

[0003] The present disclosure provides a surgical robotic system that includes a plurality of components, namely: a control tower, a console, and one or more surgical robotic arms, each of which is disposed on a movable cart and includes a surgical instrument. Each of the robotic arms is operable in one or more control modes (e.g., hold mode, move mode, position control mode, etc.). The surgical robotic system includes an error handler subsystem configured to transmit error signals between each of the components, such that each of the components is informed of error signals generated by another component. In embodiments, the error signals are transmitted between the core tower, the surgical console, and the arm cart assembly to determine which control modes should be inhibited. Certain error signals can result in a short-term (e.g., about 1 second to about 5 seconds) interruption or a long-term blockout. The short-term interruption is configured to interrupt position control of the robotic arms or other control of the components, and the long-term blockout is configured to permanently end position control until the system is restarted or the component that failed is replaced. In further embodiments, certain error signals can result in disabling manual bedside control of the robotic arms, surgical console ergonomic control, and / or other aspects of manual command motion.

[0004] The error handler subsystem also sends specific notification codes to an alert and notification subsystem, which is configured to display messages and other indicators to users of the surgical robotic system. Each of the error signals can include one or more error states indicating a prohibited action and a counter that matches between components to confirm receipt of the error signal, which acts as a signal exchange between components. The error handler subsystem coordinates short-term interruptions and long-term blockades and safe reactions to error signals occurring at any component of the system.

[0005] According to one embodiment of the present disclosure, a surgical robotic system is disclosed. The surgical robotic system includes a control tower including a first controller having a first error handler. The first controller is configured to detect a first error associated with the control tower and the first error handler is configured to generate a first error signal based on the first error. The system also includes a surgical console coupled to the control tower. The surgical console includes a display and a user input device configured to generate user input. The system further includes a mobile cart coupled to the control tower. The mobile cart includes a second controller and a second error handler. The second controller is configured to detect a second error associated with the mobile cart and the second error handler is configured to generate a second error signal based on the second error. The system also includes a surgical robotic arm disposed on the mobile cart. The surgical robotic arm includes a surgical instrument configured to treat tissue and actuatable in response to the user input and a third controller having a third error handler. The third controller is configured to detect a third error associated with the surgical robotic arm and the third error handler is configured to generate a third error signal based on the third error.

[0006] According to one aspect of the above embodiments, the surgical robotic arm is actuatable in a position control mode in response to the user input and in a manual mode in response to manual movement.

[0007] According to another aspect of the above embodiments, the system further includes an error handler network interconnecting the first error handler, the second error handler, and the third error handler, the error handler network configured to transmit the first error signal, the second error signal, and the third error signal between the first error handler, the second error handler, and the third error handler. The error handler network is configured to categorize one of the first error signal, the second error signal, and the third error signal and perform a response based on the categorization. The response can include temporarily interrupting the manual mode and disabling the position control mode.

[0008] According to another aspect of the above embodiments, one or more of the following (i.e., control tower, surgical console, or mobile cart) can include a display. The system can also include an alert and notification subsystem coupled to the error handler network, the alert and notification subsystem configured to display a notification on the display. The error handler network is configured to re-enable at least one of the manual mode and the position control mode upon the notification being dismissed by a user. The error handler network is configured to store a counter that is incremented in response to at least one of a temporary interruption of the manual mode and a disabling of the position control mode. Each of the first, second, and third error handlers stores a separate counter that is incremented in response to incrementing any of the separate counters.

[0009] According to another embodiment of the present disclosure, a surgical robotic system is disclosed. The surgical robotic system includes a control tower including a first controller having a first error handler. The first controller is configured to detect a first error associated with the control tower, and the first error handler is configured to generate a first error signal based on the first error. The system also includes a surgical console coupled to the control tower. The surgical console includes a display and a user input device configured to generate user input. The system further includes a plurality of mobile carts coupled to the control tower, each of the mobile carts including a second controller and a second error handler. The second controller is configured to detect a second error associated with the mobile cart, and the second error handler is configured to generate a second error signal based on the second error. The system also includes a plurality of surgical robotic arms, each of the surgical robotic arms disposed on one of the plurality of mobile carts. Each of the surgical robotic arms includes a surgical instrument configured to treat tissue and actuatable in response to the user input, and a third controller having a third error handler. The third controller is configured to detect a third error associated with the surgical robotic arm, and the third error handler is configured to generate a third error signal based on the third error.

[0010] According to one aspect of the above embodiments, the surgical robotic arm is actuatable in a position control mode in response to user input and in a manual mode in response to manual movement.

[0011] According to another aspect of the above embodiments, the system further includes an error handler network interconnecting the first error handler, the second error handler, and the third error handler, the error handler network configured to transmit the first error signal, the second error signal, and the third error signal between the first error handler, the second error handler, and the third error handler. The error handler network is configured to categorize one of the first error signal, the second error signal, and the third error signal and perform a response based on the categorization. The response includes temporarily interrupting the manual mode and disabling the position control mode.

[0012] According to another aspect of the above embodiments, one or more of the following (i.e., one of the control tower, the surgical control console, one of the mobile carts) includes a display. The system further includes an alert and notification subsystem coupled to the error handler network, the alert and notification subsystem configured to display a notification on the display. The error handler network is configured to re-enable at least one of the manual mode and the position control mode upon the notification being dismissed by the user. The error handler network is configured to store a counter that is incremented in response to at least one of the temporary interruption of the manual mode and the disabling of the position control mode. Each of the first error handler, the second error handler, and the third error handler stores a separate counter that is incremented in response to any of the separate counters being incremented.

[0013] According to another aspect of the above embodiments, the surgical control console includes a fourth controller having a fourth error handler, the fourth controller configured to detect a fourth error associated with the surgical control console, and the fourth error handler configured to generate a fourth error signal based on the fourth error. BRIEF DESCRIPTION OF DRAWINGS

[0014] Embodiments of the present disclosure are described herein with reference to the accompanying drawings, in which:

[0015] Figure 1 is a schematic illustration of a surgical robotic system according to the present disclosure including a control tower, a control console, and one or more surgical robotic arms;

[0016] Figure 2 is a perspective view of a surgical robotic arm of the surgical robotic system of Figure 1

[0017] Figure 3 is a perspective view of a surgical robotic arm of the surgical robotic system of Figure 1

[0018] Figure 4 is a perspective view of a surgical robotic arm of the surgical robotic system of Figure 1 ​​schematic diagram of a computer architecture of a surgical robotic system according to the present disclosure;

[0019] Figure 5 is a schematic diagram of an error handler subsystem according to the present disclosure; and

[0020] Figure 6 is a flowchart of a method for handling error signals according to the present disclosure. DETAILED DESCRIPTION

[0021] Embodiments of the disclosed surgical robotic system are described in detail with reference to the drawings, wherein like reference numerals designate similar or corresponding elements in each of the several views. As used herein, the term“distal” refers to portions of the surgical robotic system and / or surgical instruments coupled to the patient, while the term“proximal” refers to portions further from the patient.

[0022] The term“application” can include a computer program designed to perform a function, task, or activity for the benefit of a user. For example, an application can refer to software running as a standalone program or in a web browser locally or remotely, or other software understood by those skilled in the art as an application. An application can run on a controller or user device, including for example on a mobile device, IOT device, or server system.

[0023] As will be described in detail below, the present disclosure relates to a surgical robotic system including a surgical console, a control tower, and one or more movable carts having surgical robotic arms coupled to setup arms. The surgical console receives user input through one or more interface devices, which are interpreted by the control tower as movement commands for moving the surgical robotic arms. The surgical robotic arms include controllers configured to process the movement commands and generate torque commands for activating one or more actuators of the robotic arms, which in turn will move the robotic arms in response to the movement commands.

[0024] With reference to Figure 1 , the surgical robotic system 10 includes a control tower 20 connected to all components of the surgical robotic system 10, including a surgical console 30 and one or more robotic arms 40. Each of the robotic arms 40 includes a surgical instrument 50 removably coupled thereto. Each of the robotic arms 40 is also coupled to a movable cart 60.

[0025] The surgical instrument 50 is configured for use during a minimally invasive surgical procedure. In embodiments, the surgical instrument 50 can be configured for use in an open surgical procedure. In embodiments, the surgical instrument 50 can be an endoscope configured to provide a video feed to a user. In further embodiments, the surgical instrument 50 can be an electrosurgical forceps configured to seal tissue by compressing tissue between jaw members and applying electrosurgical current thereto. In further embodiments, the surgical instrument 50 can be a surgical stapler including a pair of jaws configured to grasp and clamp tissue while deploying a plurality of tissue fasteners (e.g., staples) and cutting the stapled tissue.

[0026] Each of the robotic arms 40 can include a camera 51 configured to capture video of a surgical site. The cameras 51 can be stereo cameras and can be disposed on the robotic arms 40 with the surgical instruments 50. The surgical console 30 includes a first display 32 that displays a video feed of the surgical site provided by the cameras 51 of the surgical instruments 50 disposed on the robotic arms 40 and a second display device 34 that displays a user interface for controlling the surgical robotic system 10. The surgical console 30 further includes a plurality of user interface devices, such as a foot pedal 36 and a pair of hand controller 38a and 38b used by a user to remotely control the robotic arms 40.

[0027] The control tower 20 includes a display 23, which can be a touchscreen, and outputs on a graphical user interface (GUI). The control tower 20 also serves as an interface between the surgical console 30 and the one or more robotic arms 40. Specifically, the control tower 20 is configured to control the robotic arms 40 to move the robotic arms 40 and corresponding surgical instruments 50, for example, based on a set of programmable instructions and / or input commands from the surgical console 30, such that the robotic arms 40 and surgical instruments 50 perform a desired sequence of movements in response to input from the foot pedal 36 and hand controllers 38a and 38b.

[0028] Each of the control tower 20, the surgical console 30, and the robotic arms 40 includes a respective computer 21, 31, 41. The computers 21, 31, 41 are interconnected to each other using any suitable communication network based on wired or wireless communication protocols. As used herein, the term “network,” whether singular or plural, means a data network, including but not limited to the Internet, an intranet, a wide area network, or a local area network, and is not limited to the full extent of the definition of communication networks encompassed by the present disclosure. Suitable protocols include, but are not limited to, Transmission Control Protocol / Internet Protocol (TCP / IP), User Datagram Protocol / Internet Protocol (UDP / IP), and / or Datagram Congestion Control Protocol (DCCP). Wireless communication can be implemented via one or more wireless configurations, such as radio frequency, optical, Wi-Fi, Bluetooth (an open wireless protocol designed to exchange data over short distances from fixed devices and mobile devices, thus creating personal area networks (PANs)), (“Specification of a set of high-level communication protocols using a small, low-power digital radio based on the IEEE 802.15.4-2003 standard for wireless personal area networks (WPANs)”).

[0029] The computers 21, 31, 41 can include a suitable processor (not shown) operably connected to a memory (not shown), which can include one or more of volatile, nonvolatile, magnetic, optical, or electrical media, such as read-only memory (ROM), random-access memory (RAM), electrically erasable programmable ROM (EEPROM), nonvolatile RAM (NVRAM), or flash memory. The processor can be any suitable processor (e.g., control circuitry) adapted to perform the operations, calculations, and / or instruction sets described in the present disclosure, including but not limited to a hardware processor, a field-programmable gate array (FPGA), a digital signal processor (DSP), a central processing unit (CPU), a microprocessor, and combinations thereof. It will be understood by those skilled in the art that the processor can be replaced by any logic processor (e.g., control circuitry) adapted to perform the algorithms, calculations, and / or instruction sets described herein.

[0030] Referring to Figure 2 Each of the robotic arms 40 can include a plurality of links 42a, 42b, 42c interconnected at joints 44a, 44b, 44c, respectively. The joint 44a is configured to secure the robotic arm 40 to the movable cart 60 and defines a first longitudinal axis. Referring to Figure 3 The movable cart 60 includes a riser 61 and a setup arm 62 that provides a base for mounting the robotic arms 40. The riser 61 allows the setup arm 62 to move vertically. The movable cart 60 also includes a display 69 for displaying information related to the robotic arms 40.

[0031] The setup arm 62 includes a first link 62a, a second link 62b, and a third link 62c, which provide lateral maneuverability of the robotic arm 40. The links 62a, 62b, 62c are interconnected at joints 63a and 63b, each of which can include an actuator (not shown) for rotating the links 62b and 62b relative to each other and the link 62c. Specifically, the links 62a, 62b, 62c can move in their respective lateral planes parallel to each other, allowing the robotic arm 40 to extend relative to a patient (e.g., a surgical table). In embodiments, the robotic arm 40 can be coupled to a surgical table (not shown). The setup arm 62 includes a controller 65 for adjusting the movement of the links 62a, 62b, 62c, as well as the lifter 61.

[0032] The third link 62c includes a rotatable base 64 having two degrees of freedom. Specifically, the rotatable base 64 includes a first actuator 64a and a second actuator 64b. The first actuator 64a is rotatable about a first fixed arm axis that is perpendicular to a plane defined by the third link 62c, and the second actuator 64b is rotatable about a second fixed arm axis that is transverse to the first fixed arm axis. The first and second actuators 64a, 64b allow for full three-dimensional orientation of the robotic arm 40.

[0033] The robotic arm 40 also includes a plurality of manual override buttons 53 disposed on the instrument drive unit 52 and the setup arm 62, which can be used in a manual mode. A user can press one or buttons 53 to move the component associated with the button 53.

[0034] Referring to Figure 2 , the robotic arm 40 also includes a holder 46 that defines a second longitudinal axis and is configured to receive an instrument drive unit 52 Figure 1 ) of a surgical instrument 50, which is configured to be coupled to an actuation mechanism of the surgical instrument 50. The instrument drive unit 52 transmits actuation forces from its actuators to the surgical instrument 50 to actuate components (e.g., an end effector) of the surgical instrument 50. The holder 46 includes a sliding mechanism 46a that is configured to move the instrument drive unit 52 along the second longitudinal axis defined by the holder 46. The holder 46 also includes a joint 46b that rotates the holder 46 relative to the link 42c.

[0035] The joints 44a and 44b include actuators 48a and 48b that are configured to drive the joints 44a, 44b, 44c relative to each other through a series of belts 45a and 45b or other mechanical links, such as drive rods, cables, or levers. Specifically, the actuator 48a is configured to rotate the robotic arm 40 about the longitudinal axis defined by the link 42a.

[0036] Actuator 48b of interface 44b is coupled to interface 44c via belt 45a, and interface 44c is in turn coupled to interface 46c via belt 45b. Interface 44c can include a transfer case that couples belts 45a and 45b, such that actuator 48b is configured to rotate each of links 42b, 42c and holder 46 relative to one another. More specifically, links 42b, 42c and holder 46 are passively coupled to actuator 48b, which enforces rotation about a pivot point “P” that is at the intersection of a first axis defined by link 42a and a second axis defined by holder 46. Thus, actuator 48b controls the angle Θ between the first and second axes, allowing for orientation of surgical instrument 50. As links 42a, 42b, 42c and holder 46 are interconnected via belts 45a and 45b, the angle between links 42a, 42b, 42c and holder 46 is also adjusted in order to achieve the desired angle Θ. In embodiments, some or all of interfaces 44a, 44b, 44c can include actuators to eliminate the need for mechanical linkages.

[0037] With reference to Figure 4 Each of the computers 21, 31, 41 of the surgical robotic system 10 can include a plurality of controllers that can be embodied in hardware and / or software. The computer 21 of the control tower 20 includes a controller 21a and a safety observer 21b. The controller 21a receives data from the computer 31 of the surgical console 30 regarding the current positions and / or orientations of the handle controllers 38a and 38b and the states of the foot pedals 36 and other buttons. The controller 21a processes these input positions to determine the desired drive commands for each interface of the robotic arms 40 and / or instrument drive units 52, and transmits these commands to the computer 41 of the robotic arms 40. The controller 21a also receives the actual interface angles and uses this information to determine force feedback commands that are transmitted back to the computer 31 of the surgical console 30 to provide haptic feedback through the handle controllers 38a and 38b. The safety observer 21b performs validity checks on the data entering and leaving the controller 21a, and notifies a system fault handler to place the computer 21 and / or the surgical robotic system 10 in a safe state if an error in data transmission is detected.

[0038] The computer 41 includes multiple controllers, namely a main cart controller 41a, a setup arm controller 41b, a robot arm controller 41c, and an instrument drive unit (IDU) controller 41d. The main cart controller 41a receives and processes joint commands from the controller 21a of the computer 21 and communicates these commands to the setup arm controller 41b, the robot arm controller 41c, and the IDU controller 41d. The main cart controller 41a also manages instrument exchange and the overall state of the movable cart 60, the robot arm 40, and the instrument drive unit 52. The main cart controller 41a also communicates actual joint angles back to the controller 21a.

[0039] The setup arm controller 41b controls each of the joints 63a and 63b, as well as the rotatable base 64 of the setup arm 62, and computes desired motor movement commands (e.g., motor torques) for the pitch axis and controls brakes. The robot arm controller 41c controls each joint 44a and 44b of the robot arm 40 and computes desired motor torques needed for gravity compensation, friction compensation, and closed loop position control of the robot arm 40. The robot arm controller 41c computes movement commands based on the computed torques. The computed motor commands are then communicated to one or more of the actuators 48a and 48b in the robot arm 40. Actual joint positions are then transmitted back to the robot arm controller 41c through the actuators 48a and 48b.

[0040] The IDU controller 41d receives desired joint angles of the surgical instrument 50, such as wrist and jaw angles, and computes desired currents for the motors in the instrument drive unit 52. The IDU controller 41d computes actual angles based on motor positions and transmits actual angles back to the main cart controller 41a.

[0041] The robot arm 40 is controlled as follows. First, the pose of the handle controller (e.g., handle controller 38a) controlling the robot arm 40 is converted by an eye-in-hand conversion function executed by controller 21a into a desired pose of the robot arm 40. The eye-in-hand function, as well as other functions described herein, are embodied in software executable by controller 21a or any other suitable controller described herein. The pose of one of the handle controllers 38a can be embodied as a coordinate position and roll-pitch-yaw (“RPY”) orientation relative to a coordinate reference frame fixed to the surgical console 30. The desired pose of the instrument 50 is relative to a fixed frame on the robot arm 40. The pose of the handle controller 38a is then scaled by a scaling function executed by controller 21a. In embodiments, by the scaling function, the coordinate position is scaled down and the orientation is scaled up. Additionally, controller 21a also executes a clutching function that disengages the handle controller 38a from the robot arm 40. Specifically, if certain movement limits or other thresholds are exceeded, controller 21a stops transmitting movement commands from the handle controller 38a to the robot arm 40 and essentially acts like a virtual clutch mechanism, e.g., limiting mechanical input from affecting mechanical output.

[0042] The desired pose of the robot arm 40 is based on the pose of the handle controller 38a and is then passed through an inverse kinematics function executed by controller 21a. The inverse kinematics function calculates angles of the joints 44a, 44b, 44c of the robot arm 40 that achieve the scaled and adjusted pose input through the handle controller 38a. The calculated angles are then passed to the robot arm controller 41c, which includes a joint axis controller with a proportional-derivative (PD) controller, a friction estimator module, a gravity compensator module, and a double-sided saturation block configured to limit commanded torques of the motors of the joints 44a, 44b, 44c.

[0043] Reference is made to Figure 5The present disclosure provides an error handler network 100 that includes error handlers 121a, 121b, 141a, 141b, 141c, 141d that can each be embodied as software executable by each of the corresponding controllers: controller 21a, safety observer 21b, master cart controller 41a, setup arm controller 41b, robot arm controller 41c, and IDU controller 41d. The error handler network 100 is a virtual network for transmitting signals communicated between multiple subsystems (e.g., controllers) to transmit information about errors and desired system reactions. Thus, if an error occurs at one component, the controller associated with that component (e.g., master cart controller 41a) reacts to the error with a preprogrammed response (e.g., a preprogrammed action to place the component in a safe state). The controller (e.g., master cart controller 41a) also reports the error to other subsystems, such as safety observer 21b, master cart controller 41a and setup arm controller 41b, as well as an alarm and notification subsystem. These subsystems then respond by initiating relevant safety actions. Safety actions can also define error responses that include a hard stop, such as a complete shutdown of the robotic system 10, where all modes (including manual control mode) are disabled for the remainder of the procedure until the robotic system 10 is deactivated.

[0044] The error handlers 121a-b and 141a-d are networked together to coordinate responses across system 10 and subsystem levels in an upstream / downstream and parent / child manner. Sub-subsystems (or sub-processes) refer to downstream lower level subsystems, such as robot arm controller 41c, setup arm controller 41b, and IDU controller 41d. Mid-level subsystems refer to master cart controller 41a for each mobile cart 60. The top-level subsystem is controller 21a. Thus, all other error handlers 141a-141d are downstream of error handler 121a, and error handler 141a is the parent of error handlers 141b-141d. The computer 31 of the surgical console 30 can also include a controller with an error handler that is downstream of error handler 121a and operates in a similar manner to error handlers 141a-141d.

[0045] Reference is made to Figure 6First, error signals reported by the error handlers 121a-b and 141a-141d are classified as operable errors or inoperable errors. As used herein, an operable error is an error that does not affect the normal functioning of the controller (e.g., position control of the robot arm controller 41c) and the user is only informed that an error was detected. An inoperable error is an error that disables position control of the robot arm 40 and surgical instrument 50 in response and also interrupts manual control. Each of the controllers 21a and 41a-d reacts to the error signal based on the type of error signal. The reaction can have a predetermined duration for displaying a notification and / or a predetermined duration for how long the operational mode is disabled.

[0046] The response to an inoperable error results in manual control of the robot arm 40 and / or surgical instrument 50 being interrupted without permanently disabling the robot arm 40 and surgical instrument 50. Thus, if the user is actively using manual control when an inoperable error occurs, that instance of manual control ends and the user can release the button 53 and then re-activate the button 53 to re-enter manual control.

[0047] Error signals reported by the error handlers 121a-b and 141a-141d can be further classified as recoverable or non-recoverable. The recoverability of a given error is defined at both the system level and the subsystem level. In embodiments, an error is defined as affecting the entire system 10 and one of the components, such as the movable cart 60. A system non-recoverable error indicates that the entire system 10 cannot recover back to a usable state. A subsystem non-recoverable error indicates that only the component(s) where the error occurred cannot recover back to a usable state.

[0048] When a non-recoverable error is encountered, manual control is temporarily interrupted and position control is disabled until the robot system 10 is restarted. When a recoverable error is encountered, manual control and position control are only interrupted for a period of time, which is based on whether the error is transient or persistent, and whether the error is dismissible.

[0049] Inoperable recoverable errors further include two categories: transient-type errors and persistent-type errors. Transient-type recoverable errors are further divided into transient errors and dismissible errors. Persistent-type errors include non-recoverable errors, persistent recoverable errors, and persistent dismissible recoverable errors. Thus, errors can be classified as follows:

[0050] Non-recoverable inoperable error - the affected subsystem notifies the user, disables position control, and interrupts manual control. Position control is disabled until the system is restarted.

[0051] Transient recoverable inoperable error - the affected subsystem notifies the user, interrupts position control, and interrupts manual control. All modes are available immediately after the error occurs.

[0052] Persistent recoverable inoperable error - the affected subsystem notifies the user, disables position control, and interrupts manual control. Position control is disabled until the cause of the error is resolved (e.g., by user intervention).

[0053] Transient recoverable inoperable error - the affected subsystem notifies the user, disables position control, and interrupts manual control. Position control is disabled until the user acknowledges the notification, regardless of whether the cause of the error has disappeared.

[0054] Persistent recoverable inoperable error - the affected subsystem notifies the user, disables position control, and interrupts manual control. Position control is disabled until the cause of the error is resolved (e.g., by user intervention).

[0055] Reference Figure 5 Each controller 21a and 41a-d uses a corresponding error handler 121a-b and 141a-d to communicate with other error handlers of other controllers as well as with the state machine in its own controller. When an error occurs in a subsystem, the reaction of that subsystem is to disable / interrupt control mode and then send a message to adjacent subsystems via the error handler 427. The robot arm controller 41c, setup arm controller 41b, and IDU controller 41d communicate error signals to the main cart controller 41a, which then replies with an acknowledgement of receipt and control commands. The main cart controller 41a also reports the error information up to the controller 21a, which then also replies with an acknowledgement of receipt and nominal control commands. This communication in conjunction with the specified recovery type affects the timing of the controllers 41b-d to recover nominal functionality.

[0056] Upon detecting a problem, the error handler 141b disables position control and sends an alert to an alert and notification subsystem (ANS) 150, which can be embodied as a software application and executed by the controller 21a. The ANS 150 is coupled to various inputs and outputs of the robotic system 10 and displays various audio and visual alerts and notifications on one or more of the displays 23, 32, 34, 69.

[0057] The error handler 141b then sends an error signal to the error handler 141a, which then sends an acknowledgement of the receipt of the error signal and initiates the hold protocol and stops the position control. The error signal is also sent to the controller 21a, which recognizes the system wide non-operational error and interrupts the position control or manual control of any of the robot arms 40. The controller 21a also sends a hold command to all of the robot arms 40 and sends an acknowledgement of the receipt of the error signal to the robot arms 40. In addition, the ANS 150 also independently knows the type of error, e.g., the error is a system persistent resolvable type. The controller 21a does not stop the position control of any of the robot arms 40 until the user resolves the notification and the user cannot resolve the notification until the original problem is resolved.

[0058] Accordingly, all of the robot arms 40 are locked out of position control as well as manual control. The notification appears on the GUI of one or more of the displays 23, 32, 34, 69 with a graphical "resolve" button to resolve the error. The bedside assistant can reactivate the button 53 to restore manual control. However, the user cannot restore position control because the error is a persistent resolvable type. After the problem that caused the error independently disappears, the user can then resolve the notification and the user is then able to restore position control.

[0059] The error handler network 100 includes the following conditions that are mapped to specific error states: manual mode not available for one robot arm 40, position control not available for one robot arm 40, position mode, manual mode, and hold mode not available for one robot arm 40, and position control not available for all robot arms 40. The conditions are mapped to the set of error states based on whether the error affects a subsystem, the robot system 10, or both. The mapping also depends on the error operability and resolvability. Some error states are set true when the condition is true, while other error states are set true when the condition occurs.

[0060] Non-operational resolvable errors are divided into two categories: transient and persistent. Transient resolvability includes transient errors and resolvable errors. Persistent errors include non-resolvable errors, persistent resolvable errors, and persistent resolvable resolvable errors. In transient non-operational errors, manual control and position control as well as position control of all robot arms 40 are interrupted but not disabled. In persistent non-operational errors, only manual control is interrupted and position control of all robot arms 40 is disabled. The error state mapping for system and subsystem persistent resolvable non-operational errors is the same as for persistent non-operational errors.

[0061] With respect to unrecoverable errors, certain conditions are mapped to system and / or subsystem unrecoverable errors. Unrecoverable signals indicate when an unrecoverable error has occurred in a subsystem. Each error signal generated by an error handler has its own signal pair, where the first error signal indicates that the subsystem (local) position control is unrecoverable, and the second error signal indicates that the system (global) position control is unrecoverable. The unrecoverable signals are set to true during the error state mapping and are transmitted up to the parent subsystem. In the parent error handler (e.g., error handler 121a or 141a), the unrecoverable signals (e.g., error handlers 141b-d and the parent’s unrecoverable signals) are analyzed by combining all of the unrecoverable signals using an OR operator. If activated, these signals are latched until the system is deactivated.

[0062] The error handler network 100 also stores an interrupt counter that, when exceeded, interrupts the operation of the system 10 and / or any robot arm 40. This allows the error handler network 100 to interrupt the operation of the system 10 even when the error state is de-asserted. The error handlers 141a-d have a unique subsystem interrupt counter signal and a system interrupt counter. The counter represents how many errors have occurred in that subsystem. The counter is incremented when the particular controller 41a-d is running continuously. Once the particular controller 41a-d is turned off, the counter is reset.

[0063] When an error occurs, the error handler 141b-d of that subsystem increments the counter and sends a signal up to the error handler 141a and / or the error handler 121a. The error handlers 121a and 141a detect when the counter is incremented and send an interrupt signal to its state machine. The incremented counter is then sent to the child subsystem, e.g., error handlers 141b-d. This acknowledgement transmission forms a loop, which enables the child error handlers 141b-d to acknowledge that the upstream error handlers 121a and 141a received the message.

[0064] This error acknowledgement loop is used to end the active interruption of the position control and / or manual control of the robot arm 40. When any control mode is interrupted, the error handlers 121a and 141a latch the error state true until the up counter matches the down counter. The error state can remain true for other reasons (e.g., a persistent error), but the interruption has ended.

[0065] The error handler 121a can also verify the system interrupt counter. If the condition in the sub-error handler 141b-d maps to a system-level inoperable error, the system interrupt counter is incremented and sent up to the controller 21a. The error handler 121a checks the increment, sends an interrupt signal to all controllers 41a of the mobile cart 60, and sends the incremented counter back down to the error handler 141a of the problematic robot arm 40. The sub-error handler 141b-d can not receive a direct confirmation that the system-level message has been received. Instead, since the sub-process is receiving command states from the controller 41a, the controller 41a keeps track of the counter and releases the system-level error state appropriately. In embodiments, the error handler 141b-d can also receive confirmation that the system-level message has been received.

[0066] The error handler 141a checks for a sub-system interrupt counter increment, while the error handler 121a checks for a system interrupt counter increment. The sub-error handler 141b-d that detects the error continuously flags the error state as true for a few ticks until the sub-system and system counters match. This counter system forms a loop that clears the pipeline of nominal commands. It also prevents the user from being able to command unavailable functionality within the window of time between detecting the error and the interrupt / error state signal reaching its destination.

[0067] The error handlers 121a-b and 141a-d in all sub-systems send a message to the ANS 150 about which conditions arose. Each condition has a unique alarm ID, and the ANS 150 knows which mobile cart 60 and / or robot arm 40 issued the alarm. The ANS 150 includes a database that stores a notification type and message for each alarm ID, as well as a duration of the notification. The sub-system error handlers 141a-d include a database that stores a corresponding controller reaction type and reaction duration for each alarm ID.

[0068] For a resolvable error, since the error handlers 121a-b and 141a-d do not know about notification resolution, the ANS 150 outputs a position control block signal that is sent to the controller 21a. The position control block signal defaults to false. When a resolvable error occurs, the ANS 150 sets the block signal to true, and the error handler 121a uses this signal to make position control unavailable for all robot arms 40. Even if a resolvable error does not occur in the controller 21a, the block signal from the ANS 150 to the error handler 121a causes the controller 21a to issue a command for the nominal hold signal to all lower-level state machines.

[0069] Alerts are set and cleared through the ANS 150. Alerts are set when certain conditions occur. Alerts are cleared when the conditions end. If the alerts are related to recoverable dismissible errors, these alerts are cleared immediately upon being set, as the ANS 150 enables the “dismiss” button (not shown) on the notification user interface displayed on one or more of the displays 23, 32, 34, 69 with a clear signal. Without clearing the alerts through the ANS 150, the user will not be able to dismiss the notifications, and the errors will not be transient.

[0070] For persistent dismissible errors, the alerts are cleared when the conditions end. Thus, the ANS 150 does not enable the “dismiss” button on the notification user interface until the conditions end, at which point the user is allowed to dismiss the notifications and the ANS 150 stops blocking remote operation of the controller 21a. The error signals mapped to the transient dismissible errors can still be present, but once the user acknowledges the notifications, the controller 21a is able to command position control again.

[0071] Each of the controllers 21a and 41a has an error aggregator 221a and 241a, respectively, that aggregates errors from non-controller software in its respective domain and forwards the errors to the corresponding controller 21a or 41a. The error aggregators 221a and 241a can be embodied as software applications executable by each of the corresponding controllers 21a and 41a, respectively. The error aggregator 221a aggregates errors from all nodes of the control tower 20 and the surgical console 30 and forwards the errors to the controller 21a. The error aggregator 241a aggregates errors from non-controller software on each of the movable carts 60 and forwards the errors to the master cart controller 41a. The error aggregators 221a and 241a forward the errors to the error handler 141b-d in an array that includes counters for all active errors for a particular system and subsystem, including their recoverability type. Upon receiving the array, the error handler 141b-d identifies any new errors that occurred in the form of any counter increases, as well as any active errors that occurred in the form of non-zero counter values. The error handler 141a-d uses these two conditions to create an appropriate controller response. The error handler response is the same as the response in the corresponding controller that received the error report when the error occurred.

[0072] It should be understood that various modifications can be made to the embodiments disclosed herein. In embodiments, sensors can be provided on any suitable portion of a robotic arm. Accordingly, the above description should not be construed as limiting, but merely as exemplification of various embodiments. One skilled in the art can devise other modifications which fall within the scope and spirit of the claims appended hereto.

Claims

1. A surgical robotic system comprising: a control tower including a first controller having a first error handler, the first controller configured to detect a first error associated with the control tower and the first error handler configured to generate a first error signal based on the first error; a surgical console coupled to the control tower, the surgical console including a user input device configured to generate a user input; a mobile cart coupled to the control tower, the mobile cart including a second controller and a second error handler, the second controller configured to detect a second error associated with the mobile cart and the second error handler configured to generate a second error signal based on the second error; a surgical robotic arm disposed on the mobile cart, wherein the surgical robotic arm is operable in a position control mode in response to the user input and in a manual mode in response to a manual movement, the surgical robotic arm including: a surgical instrument configured to treat tissue and actuatable in response to the user input; and a third controller having a third error handler, the third controller configured to detect a third error associated with the surgical robotic arm and the third error handler configured to generate a third error signal based on the third error; and an error handler network interconnecting the first error handler, the second error handler, and the third error handler, wherein the error handler network is configured to classify one of the first error signal, the second error signal, and the third error signal and perform a response based on the classification, and the response includes temporarily interrupting the manual mode and disabling the position control mode.

2. The surgical robotic system of claim 1, wherein the error handler network is configured to transmit the first error signal, the second error signal, and the third error signal between the first error handler, the second error handler, and the third error handler.

3. The surgical robotic system of claim 1, wherein at least one of the control tower, the surgical console, or the mobile cart includes a display.

4. The surgical robotic system of claim 3, further comprising an alarm and notification subsystem coupled to the error handler network, the alarm and notification subsystem configured to display a notification on the display.

5. The surgical robotic system of claim 4, wherein the error handler network is configured to re-enable at least one of the manual mode and the position control mode after the notification is acknowledged by a user.

6. The surgical robotic system of claim 1, wherein the error handler network is configured to store a counter that increments in response to at least one of a temporary suspension of the manual mode and a disabling of the position control mode.

7. The surgical robotic system of claim 6, wherein each of the first error handler, the second error handler, and the third error handler stores a separate counter that increments in response to causing any of the separate counters to increment.

8. A surgical robotic system, comprising: a control tower including a first controller having a first error handler, the first controller configured to detect a first error associated with the control tower and the first error handler configured to generate a first error signal based on the first error; a surgical console coupled to the control tower, the surgical console including a user input device configured to generate a user input; a plurality of mobile carts coupled to the control tower, each of the mobile carts including a second controller and a second error handler, the second controller configured to detect a second error associated with the mobile cart and the second error handler configured to generate a second error signal based on the second error; a plurality of surgical robotic arms, wherein the plurality of surgical robotic arms are operable in a position control mode in response to the user input and in a manual mode in response to a manual movement, and each of the surgical robotic arms is disposed on one of the plurality of mobile carts, each of the surgical robotic arms including: a surgical instrument configured to treat tissue and actuatable in response to the user input; and a third controller having a third error handler, the third controller configured to detect a third error associated with the surgical robotic arm and the third error handler configured to generate a third error signal based on the third error; and an error handler network interconnecting the first error handler, the second error handler, and the third error handler, wherein the error handler network is configured to sort one of the first error signal, the second error signal, and the third error signal and perform a response based on the sorting, and the response includes temporarily suspending the manual mode and disabling the position control mode.

9. The surgical robotic system of claim 8, wherein the error handler network is configured to transmit the first error signal, the second error signal, and the third error signal between the first error handler, the second error handler, and the third error handler.

10. The surgical robotic system of claim 8, wherein at least one of the control tower, the surgical console, or the mobile cart comprises a display.

11. The surgical robotic system of claim 10, further comprising an alert and notification subsystem coupled to the error handler network, the alert and notification subsystem configured to display a notification on the display.

12. The surgical robotic system of claim 11, wherein the error handler network is configured to re-enable at least one of the manual mode and the position control mode upon the notification being dismissed by a user.

13. The surgical robotic system of claim 8, wherein the error handler network is configured to store a counter that increments in response to at least one of a temporary interruption of the manual mode and a disablement of the position control mode, and each of the first, second, and third error handlers stores a separate counter that increments in response to any of the separate counters being incremented.

14. The surgical robotic system of claim 8, wherein the surgical console comprises: a fourth controller having a fourth error handler, the fourth controller configured to detect a fourth error associated with the surgical console, and the fourth error handler configured to generate a fourth error signal based on the fourth error.

Images