Operating method for a medical device and medical device
By setting up evaluation devices, control devices and monitoring devices in medical equipment, and monitoring devices are used to monitor the operation of moving elements with primary fail-safe contact elements, the collision identification problem in medical equipment is solved, and safe collision identification and risk reduction are achieved.
Patent Information
- Application Number
- CN202411632047.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-11-17
- Filing Date
- 2024-11-15
- Publication Date
- 2025-05-20
AI Technical Summary
In medical devices, with the electrification of the moving elements, the risk of personal injury increases, and it is difficult for the prior art to achieve safe collision identification, especially in implementation solutions of C paths and P paths.
By setting up evaluation devices, control devices and monitoring devices in medical equipment, the operation of moving elements is monitored using primary fail-safe contact elements and transmit collision signals through lines to achieve primary fail-safe monitoring of collisions.
It realizes primary fail-safe collision identification in medical equipment in a simple way, reduces the risk of property losses and personal injury, and is suitable for the modification of existing medical equipment.
Smart Images
Figure CN120020654A_ABST
Abstract
Description
Field of the Invention
[0001] The present invention starts from a method of operating a medical device, in which, during normal operation of the medical device, a control device of the medical device causes a moving element of the medical device to move in a controlled manner via a drive when a corresponding movement command is preset for the control device.
[0002] The drive is usually position-regulated. However, this is not necessarily required. In individual cases, speed regulation or torque regulation can also be carried out. During the controlled movement of the moving element during normal operation, the control device receives signals characterizing the movement of the moving element from sensor elements (such as a position encoder or a rotational speed sensor of the drive) and takes these signals into account when controlling the drive.
[0003] The present invention also starts from a medical device having a moving element, a drive, and a control device, in which, during normal operation of the medical device, the control device causes the moving element to move in a controlled manner via the drive when a corresponding movement command is preset for the control device.
[0004] Such a medical device and the associated operating method are generally known. An example of such a device is a C-arm facility that can move around an examination table. The moving element can, for example, be the C-arm or an element of the C-arm in this case. The moving element can also be an imaging medical facility. In this case, the moving element can, for example, be the examination table of an imaging medical facility. Another example is a medical device that moves as a whole on the ground, where the wheels of the medical device are driven such that the movement is caused or at least supported by an electric drive. In this case, the moving element is, for example, the driven wheel. Other medical devices can also be considered.
[0005] In the medical field, medical devices having moving elements that are driven by electric drives are increasingly being used. Due to the increasing electrification of movement, the risk of causing injuries, especially personal injuries, is increasing. Due to the increasing complexity of the degrees of freedom of movement, it is no longer feasible or not sufficiently feasible to monitor the movement by personnel. Therefore, in order to minimize the risk of injury, safe collision recognition is required. Background Art
[0006] In the prior art, different sensors are used to identify collisions. An example of such a sensor is a so-called bumper, a movable covering that is equipped with micro detectors and force sensors. In the prior art, the signals of these sensors are detected and evaluated by a fail-safe industrial controller. These are supposed to initiate a stop of the movement in the event of a collision.
[0007] The use of fail-safe industrial controllers is not common in the medical field. In the medical field, it is more common to implement primary fail-safety for the axes of movement of medical devices according to IEC 60601 via a C path and a parallel P path. Here, "C" represents Control, i.e., control, and "P" represents Protection, i.e., protection or monitoring. Thus, - compared to the safe industrial controller, in which all signals, including parallel primary fail-safe manipulation, are processed in at least two channels in parallel - there is only a single path (i.e., the C path) for controlling the drive. In this case, primary fail-safety is ensured by the parallel P path, which, however, does not control the drive but can only perform safety-related actions in case of a fault, typically triggering a brake or cutting off the energy supply to the drive. Summary of the Invention
[0008] The object of the present invention is to provide the possibility of implementing primary fail-safe collision recognition in a simple manner even in the case of the implementation of the C path and the parallel P path common in the medical field.
[0009] The object is achieved by an operating method having the features of an embodiment according to the invention. Advantageous designs of the operating method are the subject of this document.
[0010] According to the invention, an operating method of the type mentioned at the beginning is designed as follows
[0011] - During normal operation of the medical device
[0012] -- The evaluation device of the medical device monitors the operation of a primary fail-safe contact element provided at the medical device, in particular at a moving element, and in case of an operation, transmits a corresponding normal collision signal via a corresponding line to the control device of the medical device and a monitoring device different from the control device.
[0013] -- In case the normal collision signal is transmitted to the control device, the control device immediately terminates the movement of the moving element at least in the current direction of travel, and
[0014] -- In case the normal collision signal is transmitted to the monitoring device, the monitoring device prevents the drive from acting on the moving element, without controlling the drive itself, at the latest after a predetermined waiting time.
[0015] - When an inspection condition occurs, the control device or the monitoring device transmits an inspection command to the evaluation device.
[0016] - If a check command is sent to the evaluation device, the evaluation device transmits a corresponding special collision signal to the control device and the monitoring device via a line, and
[0017] - If there is no special collision signal expected based on the check command, the control device immediately prohibits the movement of the moving element at least in the current direction of travel and the monitoring device prevents the drive from acting on the moving element without actuating the drive itself at the latest after a predetermined waiting time.
[0018] The monitoring device is a pure monitoring device (according to IEC 60601). Therefore, there is no parallel safety-related actuation of the drive by the control device and the monitoring device. Therefore, the monitoring device does not have to receive signals characterizing the movement of the moving element. Only when a normal collision signal is transmitted to the monitoring device or when there is no expected special collision signal, the monitoring device prevents the drive from acting on the moving element. The waiting time is determined by the condition of the medical device. The waiting time is usually set (slightly) longer than the time required for the drive to stop the moving element. The type of measures taken by the monitoring device can vary widely. For example, the monitoring device can operate a brake that is provided in the drive train from the drive to the moving element. Alternatively, the monitoring device can operate a clutch so that the force transmission from the drive to the moving element is interrupted. It is also possible for the monitoring device to cut off the electrical power supply to the drive.
[0019] In addition to terminating the movement of the moving element (i.e., setting the corresponding actuation of the drive), the control device can optionally operate an additional brake depending on the status of the individual case. However, this is not necessary in all cases. This is not necessary especially when the movement chain from the drive to the moving element locks itself without actuation.
[0020] In the presence of a normal collision signal or in the absence of an expected special collision signal, the monitoring device and the control device can also additionally output corresponding messages, for example, to a higher-level device. Alternatively or additionally to transmitting to a higher-level device, the messages can also be output to the operator of the medical device, for example, via an optical signal (such as the flashing of an alarm light), via an acoustic signal (such as a beep), or via a tactilely detectable signal (such as the ejection of a pin).
[0021] The check command is output by the control device or by the monitoring device. The device that outputs the check command easily knows that a special collision signal is expected. The corresponding other device can be aware of the corresponding fact due to other circumstances. For example, it can be considered that the device that outputs the check command respectively notifies the other device that the device has output the check command. However, preferably, the other device can deduce from other facts that a special collision signal is expected. This is discussed in detail below.
[0022] In a possible design of the operating method, the evaluation device is configured as a primarily fail-safe evaluation device. In this case, the check condition can be that the medical device is in a special operation in which the control of the drive is prohibited by the control device.
[0023] The situation that the medical device is in a special operation can also be easily known to the corresponding other device, that is, to the device that does not transmit the detection command to the evaluation device.
[0024] For example, in the case where the control device generates a check command, a timer is started in the monitoring device due to the occurrence of a special operation (i.e., at the start of the special operation), and the timer runs for a specific period of time, for example, 30 seconds. During this period, the control device does not control the drive. If a collision signal is transmitted to the monitoring device via the line during this period, the monitoring device can easily interpret the collision signal as a special collision signal.
[0025] In the opposite case where the monitoring device generates a check command, for example, a timer can be started in the control device due to the occurrence of a special operation, and the timer runs for a specific period of time, for example, 30 seconds. During this period, the control device does not control the drive. If a collision signal is transmitted to the control device via the line during this period, the control device can easily interpret the collision signal as a special collision signal.
[0026] If the check condition is that the medical device is in a special operation, it must be ensured that the period between successive checks is less than the multiple failure occurring time (MFOT, English multiple failure occurring time). This can always be ensured in practice. However, for this purpose, the evaluation device needs to be configured as a primarily fail-safe evaluation device so that a single failure does not cause an unsafe state.
[0027] The special operation can be, for example, that the energy supply of the medical device has been switched on not long ago or a command for transitioning to a special operation has been preset by a superior device.
[0028] Due to the energization of the energy supply, the medical device (or its entire electronic unit) is in the start-up phase. During the start-up phase, the actuator is not actuated. Therefore, directly after the energization of the energy supply, a special operation is obtained completely automatically. For example, a transition to the special operation can be requested by a superior device after a predefined time (for example every eight hours).
[0029] Additionally feasible is that the normal collision signal has a minimum duration and the special collision signal has a duration significantly less than the minimum duration.
[0030] The process is an additional possibility for differentiating between a normal collision signal and a special collision signal. For example, based on the actually given relationships of a specific medical device, it can be known that the collision signal has a duration of at least 500 ms in the case of an actual collision. In this case, it can be caused - by a corresponding design of the evaluation device, by a corresponding design of the check command (in particular the duration) - that the special collision signal has a very short duration, for example 1 ms (or less). Such a short duration does not occur at all in the case of a normal collision signal for the specific medical device. Therefore, a differentiation between the normal collision signal and the special collision signal can be made safely and reliably. The values mentioned are only exemplary. The values can vary depending on the type of medical device and depending on the type of possible collisions.
[0031] Alternatively feasible for the check during the special operation is that the check condition lies in the expiration of a predefined monitoring period, the normal collision signal has a minimum duration and the special collision signal has a duration significantly less than the minimum duration.
[0032] In this case, the control device or the monitoring device repeatedly transmits the check command to the evaluation device after the predefined monitoring period has elapsed.
[0033] Of course, if the evaluation device is configured as a primary fail-safe evaluation device, the process is achievable. However, different from a check only during the special operation of the medical device, if the evaluation device is not configured as a primary fail-safe evaluation device, the process can also cause sufficient fail-safety. It is only necessary that the monitoring period is chosen small enough, for example set to a value of 100 ms. Generally, the criterion is that the monitoring period must be less than the so-called failure tolerance time (FTT, English failure tolerance time). In this case, the differentiation between the normal collision signal and the special collision signal can be made on the side of the other of the control device and the monitoring device based on the duration of the collision signal. The duration of the special collision signal must on the one hand be significantly less than the monitoring period and on the other hand also significantly less than the minimum duration of the normal collision signal.
[0034] The above object is also achieved by a medical device having features according to an embodiment of the present invention. Advantageous design options of the medical device are the subject matter here.
[0035] According to the present invention, a medical device of the type mentioned at the beginning is designed in such a way that
[0036] - the medical device has an evaluation device, a monitoring device different from the control device, and a primary fail-safe contact element arranged at the medical device, in particular at a moving element,
[0037] - the evaluation device is connected to the control device and the monitoring device via respective lines for transmitting collision signals, and
[0038] - the control device, the evaluation device, and the monitoring device interact with each other according to an operating method according to the present invention.
[0039] In a possible design option, the evaluation device is configured as a primary fail-safe evaluation device. In this case, the control device, the evaluation device, and the monitoring device interact with each other according to a correspondingly designed operating method, where the evaluation device must be configured as a primary fail-safe evaluation device. Here, the advantages achieved thereby also correspond to the advantages of the corresponding operating method.
[0040] As before, it is also possible that the control device, the evaluation device, and the monitoring device interact with each other according to an operating method, where the check condition is the expiration of a predetermined monitoring period, the normal collision signal has a minimum duration, and the special collision signal has a duration significantly less than the minimum duration. Here, the advantages achieved thereby also correspond to the advantages of the corresponding operating method. Description of the Drawings
[0041] The above-described characteristics, features, and advantages of the present invention, as well as the manner and method of how to achieve them, become clearer and more understandable in connection with the following description of embodiments that are described in detail in association with the drawings. Shown schematically herein are:
[0042] Figure 1 showing a medical device,
[0043] Figures 2 to 7 showing a flow chart,
[0044] Figure 8 showing an evaluation device,
[0045] Figure 9 showing a timing diagram, and
[0046] Figure 10 and 11 showing a flow chart. Detailed Description
[0047] According to Figure 1 , the medical device 1 has a moving element 2. The moving element 2 can for example be a wheel, by means of which the medical device 1 as a whole moves on the ground. Alternatively, the moving element 2 can be part of the medical device 1, which part moves relative to the other parts of the medical device 1. The movement of the moving element 2 is effected by means of an (electrical) drive 3 of the medical device 1.
[0048] The medical device 1 also has a control device 4. In the normal operation of the medical device 1, the control device 4 can preset a movement command V from the outside - for example by a superior control device (not shown) or by an operator (likewise not shown). In normal operation, the control device 4 causes the moving element 2 to move in a controlled manner via the drive 3 based on the presetting of the movement command V. Therefore, a sensor device 5 is assigned to the drive 3 (alternatively to the moving element 2), by means of which sensor device 5 a sensor signal characterizing the movement movement of the moving element 2 is detected and can be fed to the control device 4. The control device 4 takes the sensor signal into account when determining the actuation of the drive 3. Usually, position regulation is carried out, however in some cases speed regulation or alternatively torque regulation is also carried out.
[0049] The medical device 1 also has a primarily fail-safe contact element 6. The possible design options for the contact element 6 are known to the person skilled in the art. The contact element 6 is arranged at the medical device 1. In some cases, the contact element 6 can be arranged at the moving element 2. In other cases, the contact element 6, as shown in Figure 1 , is arranged at other elements of the medical device 1, for example at a guard plate.
[0050] The medical device 1 also has an evaluation device 7. The evaluation device 7 is connected to the control device 4 via a line 8 and to a monitoring device 10 via a further line 9. The evaluation device 7 monitors the operation of the contact element 6. In the event of an operation, the evaluation device 7 transmits a collision signal C to the control device 4 via the line 8 and to the monitoring device 10 via the further line 9. The collision signal C is hereinafter referred to as the normal collision signal C. The reason for the naming will become clear.
[0051] Below, in connection with Figures 2 to 4 the principle mode of operation of the evaluation device 7, the control device 4 and the monitoring device 10 is explained. The process is also modified afterwards in order to describe the invention more precisely.
[0052] According to Figure 2, the evaluation device 7 checks in step S1 whether the contact element 6 has been operated. If this is the case, the evaluation device 7 transmits a (normal) collision signal C to the control device 4 and the monitoring device 10 via lines 8 and 9 in step S2. The evaluation device 7 repeatedly executes steps S1 and S2.
[0053] The current description of the operation mode of the evaluation device 7, in terms of its description method, corresponds to running a program through a microprocessor or the like. However, this is usually not the case. Usually, the evaluation device 7 is implemented in a pure circuit technology manner.
[0054] According to Figure 3 , the control device 4 receives a movement command V in step S11. In step S12, the control device 4 checks whether a (normal) collision signal C has been transmitted to the control device by the evaluation device 7. If this is the case, the control device 4 transitions to step S13. In step S13, the control device 4 immediately terminates the active control of the drive 3, thereby terminating the movement of the moving element 2 at least in the current travel direction. In the opposite travel direction, it may be possible to allow the moving element to continue moving. If the control device 4 does not receive a (normal) collision signal C, the control device 4 transitions to step S14. In step S14, the control device 4 receives the sensor signal of the sensor device 5 from the sensor device 5. In step S15, the control device 4 determines a control command for the drive 3. The control device 4 takes into account the movement command V and the sensor signal when determining the control command. In step S16, the control device 4 outputs the determined control command to the drive 3. Subsequently, the control device 4 returns to step S11 or - as shown by the dashed line in Figure 3 - returns to step S12. Whether the control device 4 returns to step S11 or step S12 can depend on the type of the movement command V. Therefore, the control device 4 repeatedly executes steps S11 to S16. However, in the event of a collision, the repeated execution is interrupted.
[0055] The monitoring device 10 of the medical device 1 is a device different from the control device 4. The monitoring device 10 according to Figure 4 first checks in step S21 whether a movement command V is also preset for it. If the movement command V is not preset, the monitoring device 10 returns to step S21. In the case where the movement command V is preset, the monitoring device 10 releases the movement of the moving element 2 in step S22. For example, the monitoring device 10 can ventilate the brake 11 ( Figure 1 ) of the medical device 1 in step S22.
[0056] In step S23, the monitoring device 10 checks whether the (normal) collision signal C has been transmitted by the evaluation device 7 to the monitoring device. If this is the case, the monitoring device 10 proceeds to step S24. In step S24, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without actuating the drive 3 itself, at the latest after a predetermined waiting time, thereby prohibiting the continued movement of the moving element 2. Subsequently, the monitoring device 10 waits for a release signal in step S25. Only after the preset release signal does the monitoring device 10 proceed back to step S21.
[0057] If, however, no (normal) collision signal C has been transmitted by the evaluation device 7 to the monitoring device 10, the monitoring device 10 proceeds from step S23 to step S26. In step S26, the monitoring device 10 checks whether the movement command V is no longer preset. If this is the case, the monitoring device 10 proceeds to step S27. In step S27, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without actuating the drive 3 itself, at the latest after a predetermined waiting time. Subsequently, the monitoring device 10 returns to step S21. If, however, the movement command V continues to be preset, the monitoring device 10 returns from step S26 to step S22 (alternatively to S23).
[0058] The check command B (see Figure 1 ) can be transmitted to the evaluation device 7. The transmission can be carried out by the control device 4. Alternatively - but not additionally - the transmission can be carried out by the monitoring device 10. Accordingly, depending on which of the two devices 4, 10 transmits the check command B, the corresponding device 4, 10 is connected to the evaluation device 7 for this purpose. Below, it is always assumed that the transmission is carried out by the monitoring device 10. However, the reverse process is completely equivalent and analogous.
[0059] When a check condition occurs, the check command B is transmitted to the evaluation device 7. Below, different possibilities for the check condition are explained with reference to additional figures. However, regardless of the type of check condition, when the check command B is transmitted to the control device 4 and the monitoring device 10, the evaluation device 7 always transmits the collision signal C' to the control device 4 and the monitoring device 10 via lines 8, 9 corresponding to the illustration in Figure 1 . Below, the collision signal C' is referred to as the special collision signal C'.
[0060] The control device 4 and the monitoring device 10 check, if they expect a special collision signal C' based on the check command B, whether the special collision signal C' is actually transmitted to the control device and the monitoring device by the evaluation device 7. If the special collision signal C' is transmitted to the control device and the monitoring device, the normal operation of the medical device 1 is recorded or continued. If, on the other hand, the special collision signal C' does not exist, the control device 4 immediately prohibits the movement of the moving element 2 at least in the current direction of travel. Therefore, the control device 4 does not start the movement of the moving element 2 at all or terminates the movement of the moving element 2. Similarly, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without controlling the drive 3 itself at the latest after a predetermined waiting time.
[0061] Below, combined with Figures 5 to 7 Describe possible processes for implementing the process described.
[0062] Just Figure 5 and 6 It is important that, as an alternative to normal operation, the medical device 1 can be in special operation. Special operation can be, for example, that the energy supply of the medical device 1 was switched on a short time ago. In this case, the medical device 1 is in the process of starting up. It is also possible that a command for transitioning to special operation has been preset by a superior device (not shown). In the case of a dedicated special operation, the control device 4 and the monitoring device 10 are also in special operation.
[0063] In special operation, the monitoring device 10 can be implemented as follows, for example, in combination Figure 5 The process described. According to Figure 5 , the monitoring device 10 first transitions to special operation in step S31. In step S32, the monitoring device 10 transmits the check command B to the evaluation device 7. In step S33, the monitoring device 10 checks whether the collision signal C' is transmitted to the monitoring device by the evaluation device 7. Based on the fact that the monitoring device 10 is in special operation, the monitoring device 10 knows that the collision signals C, C' transmitted to it by the evaluation device 7 are special collision signals. If the evaluation device 7 transmits the special collision signal C', the monitoring device 10 transitions to normal operation ( Figure 4 ), indicated by step S34. If the evaluation device 7 does not transmit a special collision signal C', the monitoring device 10 transitions to step S35. In step S35, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without controlling the drive 3 itself. Optionally, the monitoring device 10 can additionally output a fault message to a superior device or operator in step S36. Then Figure 4 A step similar to step S36 may also be performed after step S24 in .
[0064] Similarly, the control device 4 can implement processes such as those described below in a special operation Figure 6 . According to Figure 6 , the control device 4 first transitions to the special operation in step S41. In the subsequent step S42, the control device 4 prohibits the manipulation of the drive 3.
[0065] In step S43, the control device 4 starts the timer 12 (see Figure 1 ). The timer 12 runs for a predetermined time period T0, for example, 30 seconds. In step S44, the control device 4 checks whether a collision signal C' is transmitted to the control device by the evaluation device 7. Based on the condition that the control device 4 is in the special operation, the control device 4 knows that the collision signals C and C' transmitted by the evaluation device 7 are special collision signals C'. If the evaluation device 7 transmits the special collision signal C', the control device 4 transitions to the normal operation ( Figure 3 ), as indicated by step S45.
[0066] If the evaluation device 7 does not transmit the special collision signal C', the control device 4 transitions to step S46. In step S46, the control device 4 checks whether the timer 12 has expired. As long as this is not the case, the control device 4 returns to step S44. If the timer 12 expires, then Figure 6 the process terminates from the beginning. In particular, the control device 4 does not transition to the normal operation. Thus, as a result, the control device 4 maintains the prohibition of the drive (regardless of the travel direction in this case). Optionally, the control device 4 can additionally output a fault message to a superior device or an operator in step S47. Then Figure 3 a step similar to step S47 is performed after step S13.
[0067] The evaluation device 7 also implements a method that is slightly modified with respect to Figure 2 . The method is described below in conjunction with Figure 7 . According to Figure 7 , Figure 2 the process is supplemented by step S51. In step S51, the evaluation device 7 checks whether an inspection command B is preset for the evaluation device. If this is the case, the evaluation device 7 also transmits a collision signal - in this case, the special collision signal C' - to the control device 4 and the monitoring device 10 if it does not recognize a collision in step S1. It should be noted again that although shown in a flowchart, the evaluation device 7 is generally implemented in a pure circuit technology form.
[0068] In accordance with Figures 5 to 7 , in particular Figure 5 and 6 in the case of the process, according to Figure 8The evaluation device 7 is configured as a primary fail-safe evaluation device. Accordingly, the evaluation device 7 includes two independent blocks 13, 14, where the two blocks 13, 14 monitor the operation of the contact element 6 independently of each other and transmit a (normal) collision signal C in the event of operation. Block 13 transmits the normal collision signal C to the control device 4, and block 14 transmits the normal collision signal C to the monitoring device 10. The two blocks 13, 14 - independently of each other - also convey an inspection command B, such that the two blocks 13, 14 optionally also transmit a special collision signal C' to the control device 4 or the monitoring device 10 independently of each other.
[0069] The possibility of the primary fail-safe design of the evaluation device 7 is generally known to those skilled in the art, such that no further explanation thereof is required.
[0070] Different types of differentiation between the normal collision signal and the special collision signal C, C' are also possible. In particular, it is possible to differentiate based on the duration of the collision signals C, C': whether the collision signal is a normal collision signal C or a special collision signal C'. For example, according to Figure 9 , based on the inherent characteristics of the medical device 1, it is known that a collision - whenever it occurs - always has a duration t1, which is at least as large as the minimum duration tmin. The minimum duration tmin can be, for example, 100 ms or 500 ms. Of course, other values are also possible. If it can be ensured that the special collision signal C' has a duration t2 that is significantly less than the minimum duration tmin, then it is possible to differentiate based on the duration of the collision signals C, C': whether the collision signal is a normal collision signal C or a special collision signal C'. In this case, the differentiation can be independent of whether the control device 4 and / or the monitoring device 10 is in normal operation or special operation. The duration t2 can be, for example, at most 10% of the minimum duration tmin. Of course, even smaller values are also possible. In the case where the minimum duration tmin is, for example, 100 ms, the duration t2 can be, for example, 5 ms, 2 ms, 1 ms, and even smaller values. The setting of the duration t2 can be effected, for example, by the design of the evaluation device 7, i.e., its reaction to the transmission of the inspection command B. It is also possible that the duration of the special collision signal C' is consistent with the duration of the inspection command B based on the design of the evaluation device 7 and the inspection command B has a duration t2.
[0071] As just mentioned, when the duration t2 is appropriately determined, it is also possible to differentiate between the normal collision signal C and the special collision signal C' when the control device 4 and the monitoring device 10 are in normal operation. Thus, for Figure 5 and 6Alternatively, it is feasible that the control device 4 and the monitoring device 10 operate according to the method described below in connection with Figure 10 and 11 .
[0072] According to Figure 10 , the monitoring device 10 starts two timers 15, 16 in step S61 (see Figure 1 ). Timer 15 runs for a time period T1, and timer 16 runs for a time period T2. The time period T2 is (usually only slightly) greater than the time period T1. In step S62, the monitoring device 10 checks whether a collision signal C, C' has been transmitted from the evaluation device 7 to the monitoring device. If this is the case, the monitoring device 10 proceeds to step S63. In step S63, the monitoring device 10 checks whether the transmitted collision signal C, C' has (exactly or at least approximately) a duration t2. If this is the case, the transmitted collision signal C, C' is a special collision signal C'. Accordingly, the monitoring device 10 proceeds to step S64, in which the monitoring device resets the two timers 15, 16 so that the time periods T1, T2 start running again. Starting from step S64, the monitoring device 10 proceeds to step S62. In other cases, the transmitted collision signal C, C' is a normal collision signal C. Accordingly, the monitoring device 10 proceeds to step S65. In step S65, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without manipulating the drive 3 itself at the latest after a predetermined waiting time, thereby prohibiting the moving element 2 from continuing to move. In step S66, the monitoring device 10 then waits for a release signal. After the preset release signal, the monitoring device 10 proceeds to step S61 again. Steps S65 and S66 correspond to Figure 4 steps S24 and S25 of
[0073] If the monitoring device 10 does not recognize a collision signal C, C' in step S62, the monitoring device 10 proceeds to step S67. In step S67, the monitoring device 10 checks whether timer 16 has stopped. If this is the case, there is a functional failure of the evaluation device because a special collision signal C' has been requested but not transmitted. Accordingly, the monitoring device 10 proceeds to step S65.
[0074] If timer 16 has not expired, the monitoring device 10 proceeds to step S68. In step S68, the monitoring device 10 checks whether timer 15 has expired. If this is the case, the monitoring device 10 proceeds to step S69, in which the monitoring device transmits a check command B to the evaluation device 7 to request a special collision signal C'. In other cases, the monitoring device 10 skips step S69.
[0075] In step S70, the monitoring device 10 checks whether a preset movement command V is given to it. If there is a preset movement command V, the monitoring device 10 releases the movement of the moving element 2 in step S71. In other cases, the monitoring device 10 skips step S71.
[0076] Subsequently, the monitoring device 10 checks in step S72 whether a preset movement command V is given to it. If this is the case, the monitoring device 10 transitions to step S73. In step S73, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without actuating the drive 3 itself at the latest after a predetermined waiting time. In other cases, the monitoring device 10 skips step S73. In both cases, i.e., in the case of implementing and not implementing step S73, the monitoring device 10 then returns to step S62.
[0077] According to Figure 11 , the control device 4 starts the timer 12 in step S81. In the Figure 10 and 11 design scenario, the time period T0 is consistent with the time period T2 run by the timer 16 of the monitoring device 10. In the case of step S82, the control device 4 receives the movement command V. In step S83, the control device 4 checks whether the evaluation device 7 has transmitted the collision signals C, C' to the control device. Steps S82 and S83 correspond to Figure 3 steps S11 and S12 of
[0078] If the control device 4 has transmitted the control signals C, C' in step S83, the control device 4 transitions to step S84. In step S84, the control device 4 checks whether the transmitted collision signals C, C' have (exactly or at least approximately) a duration t2. If this is the case, the transmitted collision signal C, C' is a special collision signal C'. Accordingly, the control device 4 transitions to step S85, in which the control device resets the timer 12 so that the time period T2 starts running again.
[0079] In step S86, the control device 4 then receives its sensor signals from the sensor device 5. In step S87, the control device 3 determines the actuation command for the drive 3. In step S88, the control device 4 outputs the determined actuation command to the drive 3. Subsequently, the control device 4 transitions to step S82, or as indicated by the dashed line in Figure 11 , returns to step S83. Whether the control device 4 returns to step S82 or to step S83 can be related to the type of movement command V. Steps S86 to S88 correspond to Figure 3 steps S14 to S16 of
[0080] If the transmitted collision signals C, C' do not have a duration t2, the transmitted collision signals C, C' are normal collision signals C. Accordingly, the control device 4 transitions to step S89. In step S89, the control device 4 immediately terminates the active manipulation of the drive 3 at least in the current direction of travel, thereby terminating the movement of the moving element 2 in said direction of travel. Step S89 corresponds to Figure 3 step S13
[0081] If the control device 4 does not recognize the collision signals C, C' in step S83, the control device 4 transitions to step S90. In step S90, the control device 4 checks whether the timer 12 has expired. If this is the case, there is a functional failure of the evaluation device 7 because a special collision signal C' was expected but not transmitted. Accordingly, the control device 4 transitions to step S89. If, however, the timer 12 has not expired, the control device 4 transitions to step S86.
[0082] Figure 10 and 11 the process can be implemented independently of whether the evaluation device 7 is primarily fail-safe. However, in both cases, the time periods T1, T2 must be determined appropriately. In particular, in the case of a non-primarily fail-safe design of the evaluation device 7, the time periods T1, T2 must be less than the fault tolerance time (commonly referred to as FTT). If the fault tolerance time is, for example, 100 ms, the time periods T1, T2 can be, for example, 80 ms and 81 ms. The values mentioned are of course only purely exemplary.
[0083] Thus, in summary, the present invention relates to the fact that
[0084] During the normal operation of the medical device 1, in the case of a preset corresponding movement command V, the control device 4 controls the movement of the moving element 2 of the medical device 1 in a controlled manner via the drive 3. During normal operation, the evaluation device 7 monitors the operation of the primary fail-safe contact element 6 provided at the medical device 1, and in the case of an operation, transmits a normal collision signal C to the control device 4 and the monitoring device 10 via lines 8, 9. In the case of the normal collision signal C being transmitted to the control device, the control device 4 immediately terminates the movement of the moving element 2 at least in the current travel direction, and the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without controlling the drive 3 itself at the latest after a predetermined waiting time. When the control device 4 or the monitoring device 10 detects an inspection condition, it transmits an inspection command B to the evaluation device 7. In this case, the evaluation device 7 transmits a corresponding special collision signal C' to the control device 4 and the monitoring device 10 via lines 8, 9. In the absence of the special collision signal C' expected based on the inspection command B, the control device 4 immediately prohibits the movement of the moving element 2 at least in the current travel direction, and the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without controlling the drive 3 itself at the latest after a predetermined waiting time.
[0085] The present invention has many advantages. In particular, the present invention can maintain the common and proven division into a control path (C path) and a monitoring path (P path) in a medical device, and can still implement a primary fail-safe monitoring of collisions. Thus, property damage and personal injury can be avoided in a simple manner. In particular, in the case of a design according to Figure 10 and 11 , the evaluation device 7 does not have to be primary fail-safe, and thus can be implemented compactly and at low cost. In addition, in this case, the operating safety can be basically achieved by programming the control device 4 and the monitoring device 10, so that the retrofit of the existing medical device 1 is also easily achievable.
[0086] Although the present invention has been described in detail by way of preferred embodiments, the present invention is not limited by the disclosed examples, and those skilled in the art can derive other variants therefrom without departing from the scope of protection of the present invention.
[0087] Regardless of the grammatical gender of a specific expression, persons of male or female gender are included.
Claims
1. An operating method for a medical device (1), wherein during normal operation of the medical device (1), the control device (4) of the medical device (1) moves a moving element (2) of the medical device (1) in a controlled manner via a drive (3) when a corresponding movement command (V) is preset to a control device (4) of the medical device (1), - wherein during normal operation of the medical device (1) - an evaluation device (7) of the medical device (1) monitors the operation of a primary fail-safe contact element (6) arranged at the medical device (1), in particular at the moving element (2), and in the event of an operation transmits a corresponding normal collision signal (C) via corresponding lines (8, 9) to the control device (4) of the medical device (1) and to a monitoring device (10) different from the control device (4), - in the event that a normal collision signal (C) is transmitted to the control device (4), the control device (4) immediately terminates the movement of the moving element (2) at least in the current direction of travel, and - when a normal collision signal (C) is transmitted to the monitoring device (10), the monitoring device (10) prevents the drive (3) from acting on the moving element (2) at the latest after a predetermined waiting time has elapsed without actuating the drive (3) itself, - wherein the control device (4) or the monitoring device (10) transmits a test command (B) to the evaluation device (7) when a test condition occurs, - wherein, when a check command (B) is transmitted to the evaluation device (7), the evaluation device (7) transmits a corresponding special collision signal (C') to the control device (4) and the monitoring device (10) via the lines (8, 9), and - wherein, in the absence of a specific collision signal (C') expected based on the check command (B), the control device (4) immediately prohibits the movement of the moving element (2) at least in the current direction of travel and the monitoring device (10) prevents the drive (3) from acting on the moving element (2) at the latest after a predetermined waiting time has elapsed without controlling the drive (3) itself.
2. The operating method according to claim 1, It is characterized in that The evaluation device (7) is designed as a primary fail-safe evaluation device, and the check condition is that the medical device (1) is in a special operation in which actuation of the drive (3) by the control device (4) is prohibited.
3. The operating method according to claim 2, It is characterized in that The special operation consists in that the energy supply of the medical device (1) has been switched on a short time ago or a command for transitioning to the special operation has been predefined by a higher-level device.
4. The operating method according to claim 2 or 3, It is characterized in that The normal collision signal (C) has a minimum duration (tmin) and the special collision signal (C′) has a duration (t2) that is significantly shorter than the minimum duration (tmin).
5. The operating method according to claim 1, It is characterized in that The check condition consists in that, at the expiration of a predetermined monitoring period, the normal crash signal (C) has a minimum duration (tmin) and the special crash signal (C′) has a duration (t2) which is significantly shorter than the minimum duration (tmin).
6. A medical device, comprising a moving element (2), a drive (3) and a control device (4), wherein during normal operation of the medical device, the control device (4) moves the moving element (2) in a controlled manner via the drive (3) when a corresponding movement command (V) is preset to the control device (4), - the medical device comprises an evaluation device (7), a monitoring device (10) which is different from the control device (4) and a primary fail-safe contact element (6) which is arranged on the medical device, in particular on the moving element (2), - wherein the evaluation device (7) is connected to the control device (4) and the monitoring device (10) via corresponding lines (8, 9) for transmitting a collision signal (C, C'), - wherein the control device (4) or the monitoring device (10) is connected to the evaluation device (7) for transmitting a check command (B), and - wherein the control device (4), the evaluation device (7) and the monitoring device (10) interact with one another according to the operating method according to claim 1.
7. The medical device according to claim 6, It is characterized in that The evaluation device (7) is designed as a fail-safe evaluation device, and the control device (4), the evaluation device (7) and the monitoring device (10) interact with one another according to the operating method according to claim 2, 3 or 4.
8. The medical device according to claim 6, It is characterized in that The control device (4), the evaluation device (7) and the monitoring device (10) interact with one another according to the operating method as claimed in claim 5.