Simple and reliable first-fault detection of collisions in medical devices

Abstract

During normal operation of a medical device (1), a control device (4) moves a moving element (2) of the medical device (1) in a controlled manner via a drive (3) upon the specification of corresponding movement commands (V). During normal operation, an evaluation device (7) monitors a first-fault-safe contact element (6) arranged on the medical device (1) for actuation and, in the event of actuation, transmits a normal collision signal (C) to the control device (4) and a monitoring device (10) via lines (8, 9). If a normal collision signal (C) is transmitted to it, the control device (4) immediately stops the movement of the moving element (2), at least in the current direction of travel, and the monitoring device (10) prevents the drive (3) from acting on the moving element (2) at the latest after a predetermined waiting time has elapsed without actuating the drive (3) as such.When a check condition occurs, either the control device (4) or the monitoring device (10) transmits a check command (B) to the evaluation device (7). In this case, the evaluation device (7) transmits a respective special collision signal (C') to the control device (4) and the monitoring device (10) via the lines (8, 9). If a special collision signal (C') expected on the basis of a check command (B) does not occur, the control device (4) immediately blocks movement of the moving element (2) at least in the current direction of travel, and the monitoring device (10) prevents the drive (3) from acting on the moving element (2) at the latest after the expiration of the predetermined waiting time without actuating the drive (3) as such.

Description

[0001] The present invention is based on an operating method for medical devices for realizing a first-error collision detection, - wherein, during normal operation of the medical device, a control device of the medical device moves a moving element of the medical device in a controlled manner via a drive when appropriate movement commands are given to the control device, - where during normal operation of the medical device -- an evaluation device of the medical device monitors a first-fault-safe contact element arranged on the medical device, in particular on the moving element, for actuation and, in the event of actuation, transmits a respective normal collision signal via respective lines to the control device and a monitoring device of the medical device which is different from the control device, -- the control device, in the event of a normal collision signal being transmitted to it, immediately stops the movement of the moving element at least in the current direction of travel and -- in the event of a normal collision signal being transmitted to it, the monitoring device prevents the drive from acting on the moving element at the latest after a predetermined waiting time has elapsed without actuating the drive as such, - that the monitoring device transmits a verification command to the evaluation device when a verification condition occurs, - that the evaluation device transmits a special collision signal to the monitoring device via the lines in the event of a verification command being transmitted to it, and - that in the event of a failure to receive a specific collision signal expected on the basis of a verification command, the monitoring device prevents the drive from acting on the moving element at the latest after the expiry of the predetermined waiting time without activating the drive as such.

[0002] The drive is usually position-controlled. However, this is not mandatory. In individual cases, speed control or torque control can also be implemented. During normal operation, the control device receives signals characteristic of the movement of the moving element from a sensor element (e.g., a position sensor or a speed sensor of the drive) during the controlled movement of the moving element and takes them into account when controlling the drive.

[0003] The present invention is further based on a medical device having a moving element, a drive, and a control device, wherein, during normal operation of the medical device, the control device moves the moving element in a controlled manner via the drive when appropriate movement commands are given to the control device. Such medical devices and the associated operating methods are generally known. An example of such devices are C-arm systems that can be moved around a patient table. In this case, the moving element can be, for example, the C-arm or an element of the C-arm. It can also be a medical imaging system. In this case, the moving element can be, for example, a patient bed of the medical imaging system.Another example is medical devices that are moved as a whole on the floor, with the medical device's wheels being driven, so that the movement is effected or at least assisted by an electric drive. In this case, the moving element can be a driven wheel, for example. Other medical devices are also conceivable.

[0004] In the medical field, more and more medical devices are being used that feature moving elements powered by an electric drive. Due to the increasing electrification of movement, the risk of causing damage, particularly personal injury, also increases. Due to the increasingly complex degrees of freedom of movement, monitoring of movement by personnel is not always possible or not sufficiently possible. Therefore, reliable collision detection is required to minimize the risk of damage.

[0005] In the current state of the art, various sensors are used to detect collisions. Examples of such sensors include so-called bumpers, movable covers equipped with micro switches, and force sensors. The signals from these sensors are recorded and evaluated using fail-safe industrial controllers.

[0006] These should then initiate a stop of the movement in the event of a collision.

[0007] The use of fail-safe industrial controllers is not common in the medical field. Rather, it is common practice in the medical field to implement first-fault safety for the moving axes of a medical device in accordance with IEC 60601 using a C path and a parallel P path. "C" stands for control, and P for protection. Thus, in contrast to a safe industrial controller, which uses parallel, at least two-channel processing of all signals, including parallel first-fault safety control, there is only a single path for controlling the drive (namely the C path).In this case, first-fault safety is ensured by the parallel P-path, which, however, does not control the drive but can only perform a safety-related action in the event of a fault, typically triggering a brake or switching off the electrical power supply of the drive.

[0008] DE 10 2022 204 210 A1 discloses an operating method for a medical device in which, during normal operation of the medical device, a control device of the medical device moves a moving element of the medical device in a controlled manner via a drive when appropriate movement commands are issued to the control device. First-fault-safe contact elements arranged on the medical device are monitored for actuation. In the event of actuation, a respective collision signal is transmitted via respective lines to the control device and a monitoring device of the medical device that is different from the control device. If a collision signal is transmitted to it, the control device immediately stops moving the moving element, at least in the current direction of travel.In the event of a collision signal being transmitted to it, the monitoring device prevents the drive from acting on the moving element at the latest after a predetermined waiting time has elapsed without actuating the drive itself. The monitoring device periodically executes a safety test procedure by simulating a collision at the collision sensor input to test the collision sensor. The monitoring device checks the feedback from the collision sensor.

[0009] US 2020 / 0 073 786 A1 discloses an operating method for a safety-related circuit to which various components for monitoring the circuit are assigned. The circuit can be used for various purposes, for example, to control an automobile, a medical device, or an aircraft. Examples of a medical device include a pacemaker and a medical monitoring circuit. US 2020 / 0 073 786 A1 does not specify what the safety-critical circuit monitors or controls. It includes an error management component that initiates the generation of error signals for components to be tested.

[0010] US 2021 / 0 055 718 A1 discloses an interaction of various data technology components that can be used to detect malfunctions in a device. It is mentioned in passing that the device can be a device for medical activities. US 2021 / 0 055 718 A1 essentially deals with industrial systems and facilities and their control and monitoring.

[0011] From US 2022 / 0 297 706 A1, a variety of procedures are known by means of which a wide variety of sensor data can be fused and compared with each other in order, for example, to ensure the timely detection of objects before a vehicle collides with the object.

[0012] The object of the present invention is to create possibilities by means of which a first-fault-safe collision detection can be realized in a simple manner even in the case of a C-path and a P-path parallel to it, which is common in the medical field.

[0013] The object is achieved by an operating method having the features of claim 1. Advantageous embodiments of the operating method are the subject of dependent claims 2 to 4.

[0014] According to the invention, an operating method of the type mentioned at the outset is designed in that - that, as an alternative to the monitoring device, the control device transmits the verification command to the evaluation device, - that the evaluation device transmits a special collision signal to both the control device and the monitoring device via the lines in the event of a verification command being transmitted to it, - that in the event of a special collision signal expected on the basis of a verification command not being received, the control device immediately blocks movement of the moving element at least in the current direction of travel and - that a normal collision signal has a minimum duration and a special collision signal has a duration which is considerably less than the minimum duration.

[0015] The monitoring device is a pure monitoring device (according to IEC 60601). Therefore, there is no parallel safety-related control of the drive by the control device and the monitoring device. The monitoring device therefore does not need to receive any signals characteristic of the movement of the moving element. It simply prevents the drive from acting on the moving element if a normal collision signal is transmitted to it or if an expected special collision signal does not occur. The waiting time is determined by the specific characteristics of the medical device. It is usually (slightly) longer than the time required for the drive to stop the moving element. The type of action taken by the monitoring device can be of various kinds.For example, the monitoring device can actuate a brake located in the drive train from the drive to the moving element. Alternatively, the monitoring device can actuate a clutch, interrupting the power transmission from the drive to the moving element. It is also possible for the monitoring device to shut off the electrical power supply to the drive.

[0016] Depending on the specific situation, the control device can, in addition to stopping the movement of the moving element (i.e., setting the corresponding control of the drive), also apply a (possibly additional) brake. However, this is not necessary in all cases. This is particularly unnecessary if the kinematic chain from the drive to the moving element is self-locking in the absence of control.

[0017] In the event of a normal collision signal or the absence of an expected special collision signal, the monitoring device and the control device can also output a corresponding message, for example, to a higher-level device. Alternatively or in addition to transmission to a higher-level device, the message can also be output to an operator of the medical device, for example via a visual signal (e.g., a flashing alarm light), an acoustic signal (e.g., a beep), or a haptic signal (e.g., the extension of a pin).

[0018] The check command is issued either by the control device or by the monitoring device. The device issuing the check command readily knows that a particular collision signal is expected. The other device may be aware of the corresponding situation due to other circumstances. For example, it is conceivable that the device issuing the check command informs the other device that it has issued the check command. Preferably, however, the other device can deduce from other circumstances that a particular collision signal is expected. This will be discussed in more detail below.

[0019] In one possible embodiment of the operating method, the evaluation device is designed as a single-fault-safe evaluation device. In this case, the verification condition can be that the medical device is in a special mode in which control of the drive by the control device is blocked.

[0020] The fact that the medical device is in special operation may easily be known to the other facility, i.e. the facility that does not transmit the verification command to the evaluation facility.

[0021] For example, if the control device generates the check command, a timer can be started within the monitoring device based on the occurrence of the special operation (i.e., at the beginning of the special operation). This timer runs for a specific period of time, for example, 30 seconds. During this period, the control device does not control the drive. If a collision signal is transmitted to the monitoring device via the cables during this period, the monitoring device can easily interpret this collision signal as a special collision signal.

[0022] In the opposite case, where the monitoring device generates the check command, the occurrence of the special operation can, for example, trigger a timer within the control device that runs for a specific period of time, for example, 30 seconds. During this period, the control device does not control the drive. If a collision signal is transmitted to the control device via the cables during this period, the control device can easily interpret this collision signal as a special collision signal.

[0023] If the verification condition requires the medical device to be in a special mode, it must be ensured that the time interval between consecutive verifications is less than the multiple failure occurring time (MFOT). This can always be achieved in practice. However, this requires the evaluation device to be designed as a single-fault-safe evaluation device to ensure that a single failure does not lead to an unsafe condition.

[0024] The special operation may, for example, consist of the medical device's power supply having been switched on shortly beforehand or a command for a transition to special operation having been given by a higher-level facility.

[0025] When the power supply is switched on, the medical device (or its entire electronics) enters a start-up phase. During the start-up phase, no drives are activated. Immediately after the power supply is switched on, special operation occurs automatically. The higher-level device can request the transition to special operation, for example, after a predetermined period of time (e.g., every 8 hours).

[0026] The fact that a normal collision signal has a minimum duration and a special collision signal has a duration that is significantly shorter than the minimum duration represents a simple and reliable way of distinguishing between a normal and a special collision signal. For example, based on the actual conditions of the specific medical device, it may be known that a collision signal in the event of an actual collision has a duration of at least 500 ms. In this case, it is possible – either through appropriate design of the evaluation device or through appropriate configuration (in particular duration) of the check command – to ensure that the special collision signal has a very short duration of, for example, 1 ms (or less). Such a short duration cannot even occur for a normal collision signal in the specific medical device.This allows a safe and reliable distinction to be made between a normal and a special collision signal. The numerical values ​​given are only examples. They may vary depending on the type of medical device and the type of potential collision.

[0027] As an alternative to checking during a special operation, it is possible for the check condition to be met at the end of a predetermined monitoring period. In this case, the control device or monitoring device repeatedly transmits a check command to the evaluation device after the expiration of the predetermined monitoring period.

[0028] This procedure is of course also feasible if the evaluation device is designed as a first-fault-safe evaluation device. In contrast to a check only during a special operation of the medical device, however, this procedure can also ensure sufficient fault tolerance if the evaluation device is not designed as a first-fault-safe evaluation device. It is only necessary to select a sufficiently short monitoring period, for example, a value of 100 ms. In general, the criterion is that the monitoring period must be shorter than the so-called failure tolerance time (FTT). In this case, the distinction between a normal and a special collision signal can be made on the part of the other control device and the monitoring device based on the duration of the collision signal.The duration of the special collision signal must be, on the one hand, considerably shorter than the monitoring period and, on the other hand, considerably shorter than the minimum duration of a normal collision signal.

[0029] The object is further achieved by a medical device having the features of claim 5. Advantageous embodiments of the medical device are the subject of dependent claims 6 and 7.

[0030] According to the invention, a medical device of the type mentioned at the outset is designed in that - that the medical device has an evaluation device, a monitoring device different from the control device and a first-fault-proof contact element arranged on the medical device, in particular on the moving element, - that the evaluation device for transmitting collision signals is connected to the control device and the monitoring device via respective lines and - that the control device, the evaluation device and the monitoring device interact with one another according to an operating method according to the invention.

[0031] In one possible embodiment, the evaluation device is designed as a first-fault-safe evaluation device. In this case, the control device, the evaluation device, and the monitoring device can interact according to a correspondingly designed operating method, in which the evaluation device must be designed as a first-fault-safe evaluation device. Here, too, the advantages achieved thereby correspond to those of the corresponding operating method.

[0032] Furthermore, as before, it is possible for the control device, the evaluation device, and the monitoring device to interact with one another according to an operating method in which the verification condition is met at the end of a predetermined monitoring period. Here, too, the advantages achieved thereby correspond to those of the corresponding operating method.

[0033] The above-described properties, features, and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more readily understood in connection with the following description of the embodiments, which are explained in more detail in conjunction with the drawings. Herein, in schematic representation: Fig. 1 a medical device, Fig. 2 to 7 flow charts, Fig. 8 an evaluation device, Fig. 9 a time diagram and Fig. 10 and Fig. 11 flowcharts.

[0034] According to Fig. 1, a medical device 1 has a moving element 2. The moving element 2 can, for example, be a wheel with which the medical device 1 is moved as a whole on a floor. Alternatively, the moving element 2 can be a part of the medical device 1 that is moved relative to another part of the medical device 1. The movement of the moving element 2 is effected by means of an (electric) drive 3 of the medical device 1.

[0035] The medical device 1 further comprises a control device 4. During normal operation of the medical device 1, travel commands V can be given to the control device 4 from outside - for example, by a higher-level control device (not shown) or by an operator (also not shown). During normal operation, the control device 4 moves the moving element 2 via the drive 3 based on the travel commands V. A sensor system 5 is therefore assigned to the drive 3 (alternatively to the moving element 2), by means of which sensor signals characteristic of the travel movement of the moving element 2 can be detected and fed to the control device 4. The control device 4 takes the sensor signals into account when determining the control of the drive 3. As a rule, position control is carried out, but in some cases speed control or alternatively torque control is also used.

[0036] The medical device 1 further comprises a first-fault-safe contact element 6. Possible configurations for the contact element 6 are generally known to those skilled in the art. The contact element 6 is arranged on the medical device 1. In some cases, the contact element 6 can be arranged on the moving element 2. In other cases, the contact element 6, as in Fig. 1, arranged on another element of the medical device 1, for example a covering plate.

[0037] The medical device 1 also has an evaluation device 7. The evaluation device 7 is connected to the control device 4 via a line 8 and to a monitoring device 10 via a further line 9. The evaluation device 7 monitors the contact element 6 for actuation. In the event of actuation, the evaluation device 7 transmits a collision signal C to the control device 4 via line 8 and a collision signal C to the monitoring device 10 via the further line 9. The collision signals C are referred to below as normal collision signals C. The reason for this designation will become apparent later.

[0038] The following are in connection with the Fig. 2 to 4 explain the basic functions of the evaluation device 7, the control device 4, and the monitoring device 10. These procedures will be modified later to explain the present invention in more detail.

[0039] According to Fig. 2, the evaluation device 7 checks in a step S1 whether the contact element 6 has been actuated. If this is the case, the evaluation device 7 transmits the (normal) collision signals C to the control device 4 and the monitoring device 10 via the lines 8, 9 in a step S2. The evaluation device 7 repeatedly executes steps S1 and S2 iteratively.

[0040] The present explanation of the functionality of the evaluation device 7 corresponds, in terms of its representation, to the execution of a program by a microprocessor or the like. However, this is generally not the case. The evaluation device 7 is generally implemented purely in circuitry.

[0041] According to Fig. 3, the control device 4 receives the travel commands V in a step S11. In a step S12, the control device 4 checks whether a (normal) collision signal C has been transmitted to it by the evaluation device 7. If this is the case, the control device 4 proceeds to a step S13. In step S13, the control device 4 immediately terminates the active control of the drive 3 and thus the movement of the moving element 2, at least in the current direction of travel. In the opposite direction of travel, further movement of the moving element may possibly be permitted. If the control device 4 does not receive a (normal) collision signal C, the control device 4 proceeds to a step S14. In step S14, the control device 4 receives the sensor signals from the sensor system 5. In a step S15, the control device 4 determines control commands for the drive 3.When determining the control commands, the control device 4 takes into account both the travel commands V and the sensor signals. In a step S16, the control device 4 outputs the determined control commands to the drive 3. The control device 4 then proceeds to step S11 or - in . Fig. 3 shown in dashed lines - returns to step S12. Whether the control device 4 returns to step S11 or step S12 can depend on the type of travel commands V. The control device 4 thus repeatedly executes steps S11 to S16 iteratively. However, the iterative execution is aborted in the event of a collision.

[0042] The monitoring device 10 of the medical device 1 is a different device from the control device 4. The monitoring device 10 checks according to Fig. 4 first checks in a step S21 whether the movement command V is also given to it. If the movement command V is not given, the monitoring device 10 returns to step S21. If the movement command V is given, the monitoring device 10 enables the movement of the moving element 2 in a step S22. For example, the monitoring device 10 can activate a brake 11 ( Fig. 1) of the medical device 1.

[0043] In a step S23, the monitoring device 10 checks whether a (normal) collision signal C has been transmitted to it by the evaluation device 7. If this is the case, the monitoring device 10 proceeds to a step S24. In step S24, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 at the latest after a predetermined waiting time has elapsed without actuating the drive 3 as such, thereby blocking further movement of the moving element 2. The monitoring device 10 then waits for an enable signal in a step S25. Only after the enable signal has been provided does the monitoring device 10 proceed to step S21.

[0044] If, however, no (normal) collision signal C was transmitted to the monitoring device 10 by the evaluation device 7, the monitoring device 10 proceeds from step S23 to step S26. In step S26, the monitoring device 10 checks whether the travel command V is no longer specified. If this is the case, the monitoring device 10 proceeds to step S27. In step S27, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 at the latest after the predetermined waiting time has elapsed without the drive 3 being activated as such. The monitoring device 10 then returns to step S21. If, however, the travel command V is still specified, the monitoring device 10 returns from step S26 to step S22 (alternatively to step S23).

[0045] A check command B (see Fig. 1). The transmission can be carried out by the control device 4. Alternatively—but not additionally—the transmission can be carried out by the monitoring device 10. Depending on which of the two devices 4, 10 transmits the check command B, the corresponding device 4, 10 is connected to the evaluation device 7 for this purpose. In the following, it is always assumed that the transmission is carried out by the monitoring device 10. The reverse procedure, however, is completely equivalent and analogous.

[0046] The transmission of the verification command B to the evaluation device 7 occurs when a verification condition occurs. Various possibilities for the verification condition are explained below in conjunction with the other FIGS. Regardless of the type of verification condition, however, the evaluation device 7 transmits the verification command B as shown in Fig. 1 always sends a collision signal C' to the control device 4 and the monitoring device 10 via lines 8, 9 when a check command B is transmitted to them. The collision signals C' are hereinafter referred to as special collision signals C'.

[0047] In situations in which they expect a special collision signal C' based on a check command B, the control device 4 and the monitoring device 10 check whether a special collision signal C' is actually being transmitted to them by the evaluation device 7. If the special collision signal C' is transmitted to them, normal operation of the medical device 1 is resumed or continued. If, however, the special collision signal C' is not received, the control device 4 immediately blocks any movement of the moving element 2, at least in the current direction of travel. The control device 4 therefore either does not begin moving the moving element 2 at all or terminates the movement of the moving element 2. Likewise, the monitoring device 10 prevents any action by the drive 3 on the moving element 2, at the latest after the expiration of the predetermined waiting time without actuating the drive 3 as such.

[0048] The following is in connection with the Fig. 5 to 7 explain a possible approach to implementing this procedure.

[0049] As far as the Fig. 5 and Fig. 6, it is relevant that the medical device 1 can be in a special mode as an alternative to normal operation. The special mode can, for example, consist of a power supply to the medical device 1 having been switched on shortly beforehand. In this case, the medical device 1 is in a startup phase. It is also possible that a command for a transition to special mode has been issued by a higher-level device (not shown). In the case of a dedicated special mode, the control device 4 and the monitoring device 10 are also in a special mode.

[0050] In special operation, the monitoring device 10 can, for example, implement a procedure as described below in connection with Fig. 5. According to Fig. 5, the monitoring device 10 initially enters special operation in a step S31. In a step S32, the monitoring device 10 transmits the check command B to the evaluation device 7. In a step S33, the monitoring device 10 checks whether a collision signal C' is being transmitted to it by the evaluation device 7. Due to the fact that the monitoring device 10 is in special operation, the monitoring device 10 knows that a collision signal C, C' transmitted by the evaluation device 7 is a special collision signal C'. If the evaluation device 7 transmits the special collision signal C', the monitoring device 10 proceeds to normal operation, indicated by a step S34 ( Fig. 4). If the evaluation device 7 does not transmit the special collision signal C', the monitoring device 10 proceeds to step S35. In step S35, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 without controlling the drive 3 as such. If necessary, the monitoring device 10 can additionally output an error message to a higher-level device or to an operator in step S36. A step analogous to step S36 can also be carried out following step S24 of Fig. 4.

[0051] Similarly, the control device 4 can, for example, implement a procedure in special operation as described below in connection with Fig. 6. According to Fig. 6, the control device 4 initially enters special operation in a step S41. In a subsequent step S42, the control device 4 blocks activation of the drive 3.

[0052] In a step S43, the control device 4 starts a timer 12 (see Fig. 1). The timer 12 runs for a predetermined period of time T0, for example, 30 seconds. In a step S44, the control device 4 checks whether a collision signal C' is being transmitted to it by the evaluation device 7. Due to the fact that the control device 4 is in special mode, the control device 4 knows that a collision signal C, C' transmitted by the evaluation device 7 is a special collision signal C'. If the evaluation device 7 transmits the special collision signal C', the control device 4 proceeds to normal operation, indicated by a step S45 ( Fig. 3) over.

[0053] If the evaluation device 7 does not transmit the special collision signal C', the control device 4 proceeds to step S46. In step S46, the control device 4 checks whether the timer 12 has expired. As long as this is not the case, the control device 4 returns to step S44. If, however, the timer 12 has expired, the procedure of Fig. 6 is terminated from the outset. In particular, the control device 4 does not return to normal operation. As a result, the control device 4 maintains the blocking of the drive 3 (in this case, regardless of the direction of travel). If necessary, the control device 4 can additionally output an error message to the higher-level device or to the operator in a step S47. A step analogous to step S47 can also be carried out following step S13 of Fig. 3.

[0054] The evaluation device 7 also carries out a Fig. 2 slightly modified procedure. This procedure is described below in conjunction with Fig. 7. According to Fig. 7 is the procedure of Fig. 2 is supplemented by a step S51. In step S51, the evaluation device 7 checks whether a verification command B has been specified. If this is the case, the evaluation device 7 transmits a collision signal—in this case, a special collision signal C'—to the control device 4 and the monitoring device 10, even if it did not detect a collision in step S1. It should be noted again that, despite the representation in the form of a flowchart, the evaluation device 7 is generally implemented purely in circuitry.

[0055] In case of the procedure according to the Fig. 5 to 7, especially the Fig. 5 and Fig. 6, the evaluation device 7 is in accordance with Fig. 8 is designed as a first-fault-safe evaluation device. The evaluation device 7 thus comprises two mutually independent blocks 13, 14, wherein both blocks 13, 14 independently monitor the contact element 6 for actuation and, in the event of actuation, transmit a (normal) collision signal C. Block 13 transmits a normal collision signal C to the control device 4, and block 14 transmits a normal collision signal C to the monitoring device 10. Both blocks 13, 14 are also supplied - independently of one another - with the check command B, so that the two blocks 13, 14 may also independently transmit a special collision signal C' to the control device 4 or the monitoring device 10.

[0056] Possibilities for the first-fault-proof design of the evaluation device 7 are generally known to experts, so that no further explanations are necessary.

[0057] Based on the duration of a collision signal C, C', it can be distinguished whether it is a normal collision signal C or a special collision signal C'. For example, according to Fig. 9 Due to the intrinsic properties of the medical device 1, it should be known that a collision - if it occurs - always has a duration t1 that is at least as long as a minimum duration tmin. The minimum duration tmin can be, for example, 100 ms or 500 ms. Of course, other values ​​are also possible. If it can be guaranteed that a special collision signal C' has a duration t2 that is significantly shorter than the minimum duration tmin, then the duration of the collision signal C, C' can be used to distinguish whether it is a normal collision signal C or a special collision signal C'. The distinction is possible regardless of whether the control device 4 and / or the monitoring device 10 are in normal operation or special operation. The duration t2 can, for example, be a maximum of 10% of the minimum duration tmin. Of course, even smaller values ​​are also possible.For a minimum duration tmin of, for example, 100 ms, the duration t2 can be, for example, 5 ms, 2 ms, 1 ms, or even smaller values. The duration t2 can be set, for example, by the configuration of the evaluation device 7, i.e., its reaction to the transmission of a verification command B.

[0058] It is also possible that the duration of the special collision signal C' corresponds to the duration of the check command B due to the design of the evaluation device 7 and that the check command B has the duration t2.

[0059] As just mentioned, with a suitable determination of the duration t2, a distinction between a normal collision signal C and a special collision signal C' is possible even when the control device 4 and the monitoring device 10 are in normal operation. As an alternative to the procedure of the Fig. 5 and Fig. 6, it is therefore possible to operate the control device 4 and the monitoring device 10 according to methods as described below in connection with the Fig. 10 and Fig. 11 will be explained.

[0060] According to Fig. 10, the monitoring device 10 starts two timers 15, 16 in a step S61 (see Fig. 1). Timer 15 runs for a time period T1, timer 16 for a time period T2. Time period T2 is (often only slightly) longer than time period T1. In a step S62, monitoring device 10 checks whether a collision signal C, C' has been transmitted to it by evaluation device 7. If this is the case, monitoring device 10 proceeds to a step S63. In step S63, monitoring device 10 checks whether the transmitted collision signal C, C' has (exactly or at least approximately) the duration t2. If this is the case, the transmitted collision signal C, C' is a special collision signal C'. Monitoring device 10 therefore proceeds to a step S64, in which it resets both timers 15, 16 so that time periods T1, T2 begin to run again. From step S64, the monitoring device 10 returns to step S62. Otherwise, the transmitted collision signal C, C' is a normal collision signal C.The monitoring device 10 therefore proceeds to step S65. In step S65, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 at the latest after the predetermined waiting time has elapsed without actuating the drive 3 as such, thereby blocking further movement of the moving element 2. In step S66, the monitoring device 10 then waits for an enable signal. Only after the enable signal has been provided does the monitoring device 10 return to step S61. Steps S65 and S66 correspond to steps S24 and S25 of . Fig. 4.

[0061] If the monitoring device 10 does not detect a collision signal C, C' in step S62, the monitoring device 10 proceeds to step S67. In step S67, the monitoring device 10 checks whether the timer 16 has expired. If this is the case, there is a malfunction in the evaluation device 7 because a special collision signal C' was requested but not transmitted. Therefore, the monitoring device 10 proceeds to step S65.

[0062] If the timer 16 has not yet expired, the monitoring device 10 proceeds to step S68. In step S68, the monitoring device 10 checks whether the timer 15 has expired. If so, the monitoring device 10 proceeds to step S69, in which it transmits a check command B to the evaluation device 7, thus requesting a special collision signal C'. Otherwise, the monitoring device 10 skips step S69.

[0063] In a step S70, the monitoring device 10 checks whether the movement command V is also specified. If the movement command V is specified, the monitoring device 10 enables the movement of the moving element 2 in a step S71. Otherwise, the monitoring device 10 skips step S71.

[0064] The monitoring device 10 then checks in step S72 whether the movement command V is not being specified. If this is the case, the monitoring device 10 proceeds to step S73. In step S73, the monitoring device 10 prevents the drive 3 from acting on the moving element 2 at the latest after the predetermined waiting time has elapsed without actuating the drive 3 as such. Otherwise, the monitoring device 10 skips step S73. In both cases, i.e., both with and without execution of step S73, the monitoring device 10 then returns to step S62.

[0065] According to Fig. 11, the control device 4 starts the timer 12 in a step S81. In the case of the embodiment of the Fig. 10 and Fig. 11, the time period T0 corresponds to the time period T2, which the timer 16 of the monitoring device 10 is running. In a step S82, the control device 4 receives the travel commands V. In a step S83, the control device 4 checks whether a collision signal C, C' has been transmitted to it by the evaluation device 7. Steps S82 and S83 correspond to steps S11 and S12 of Fig. 3.

[0066] If a collision signal C, C' was transmitted to the control device 4 in step S83, the control device 4 proceeds to step S84. In step S84, the control device 4 checks whether the transmitted collision signal C, C' has (exactly or at least approximately) the duration t2. If this is the case, the transmitted collision signal C, C' is a special collision signal C'. The control device 4 therefore proceeds to step S85, in which it resets the timer 12 so that the time period T2 begins to run again.

[0067] In a step S86, the control device 4 then receives the sensor signals from the sensor system 5. In a step S87, the control device 4 determines control commands for the drive 3. In a step S88, the control device 4 outputs the determined control commands to the drive 3. The control device 4 then proceeds to step S82 or, as in Fig. 11, returns to step S83. Whether the control device 4 returns to step S82 or to step S83 may depend on the type of movement commands V. Steps S86 to S88 correspond to steps S14 to S16 of Fig. 3.

[0068] If the transmitted collision signal C, C' does not have the duration t2, the transmitted collision signal C, C' is a normal collision signal C. The control device 4 therefore proceeds to step S89. In step S89, the control device 4 immediately terminates the active control of the drive 3 at least in the current direction of travel and thus the movement of the moving element 2 in this direction of travel. Step S89 corresponds to step S13 of Fig. 3.

[0069] If the control device 4 does not detect a collision signal C, C' in step S83, the control device 4 proceeds to step S90. In step S90, the control device 4 checks whether the timer 12 has expired. If this is the case, there is a malfunction in the evaluation device 7 because a special collision signal C' was expected but was not transmitted. Therefore, the control device 4 proceeds to step S89. If, however, the timer 12 has not yet expired, the control device 4 proceeds to step S86.

[0070] The approach of the Fig. 10 and Fig. 11 can be implemented regardless of whether the evaluation device 7 is designed to be first-fault-proof or not. In both cases, however, the time periods T1, T2 must be suitably determined. In particular, if the evaluation device 7 is not designed to be first-fault-proof, the time periods T1, T2 must be shorter than the fault tolerance time (commonly referred to as FTT). If the fault tolerance time is 100 ms, for example, the time periods T1, T2 can be 80 ms and 81 ms, for example. The numerical values ​​mentioned are, of course, purely exemplary.

[0071] In summary, the present invention relates to the following: During normal operation of a medical device 1, a control device 4, upon specification of corresponding travel commands V, moves a moving element 2 of the medical device 1 in a controlled manner via a drive 3. During normal operation, an evaluation device 7 monitors a first-fault-safe contact element 6 arranged on the medical device 1 for actuation and, in the event of actuation, transmits a normal collision signal C to the control device 4 and a monitoring device 10 via lines 8, 9. In the event of a normal collision signal C being transmitted to it, the control device 4 immediately terminates the movement of the moving element 2, at least in the current direction of travel, and the monitoring device 10 prevents the drive 3 from acting on the moving element 2, at the latest after the expiration of the predetermined waiting time without actuating the drive 3 as such.When a check condition occurs, either the control device 4 or the monitoring device 10 transmits a check command B to the evaluation device 7. In this case, the evaluation device 7 transmits a respective special collision signal C' to the control device 4 and the monitoring device 10 via the lines 8, 9. In the event of a special collision signal C' expected on the basis of a check command B not occurring, the control device 4 blocks movement of the moving element 2 at least in the current direction of travel and the monitoring device 10 prevents the drive 3 from acting on the moving element 2 at the latest after the expiration of the predetermined waiting time without actuating the drive 3 as such.

[0072] The present invention has many advantages. In particular, the usual and proven division into a control path (C-path) and a monitoring path (P-path) in medical devices can be retained, while still implementing first-fault-safe monitoring for collisions. This makes it easy to prevent damage to property and personal injury. Especially in the case of the design according to the Fig. 10 and Fig.11, the evaluation device 7 does not need to be single-fault safe and can therefore be implemented compactly and cost-effectively. Furthermore, in this case, operational reliability can be achieved essentially by programming the control device 4 and the monitoring device 10, so that retrofitting of existing medical devices 1 is also readily possible. A normal collision signal C has a minimum duration tmin. A special collision signal C' has a duration t2 that is considerably shorter than the minimum duration tmin.

[0073] Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited to the disclosed examples and other variations may be derived therefrom by those skilled in the art without departing from the scope of the invention.

[0074] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identity are included.

Claims

[1] Operating method for a medical device (1) for implementing a first-fault-safe collision detection, wherein, in normal operation of the medical device (1), a control device (4) of the medical device (1) moves a moving element (2) of the medical device (1) in a controlled manner via a drive (3) when corresponding movement commands (V) are given to the control device (4), - where during normal operation of the medical device (1) -- an evaluation device (7) of the medical device (1) monitors a first-fault-safe contact element (6) arranged on the medical device (1), in particular on the moving element (2), for actuation and, in the event of actuation, transmits a respective normal collision signal (C) to the control device (4) and a monitoring device (10) of the medical device (1) which is different from the control device (4) via respective lines (8, 9), -- the control device (4) immediately stops the movement of the moving element (2) at least in the current direction of travel in the event of a normal collision signal (C) being transmitted to it and -- in the event of a normal collision signal (C) being transmitted to it, the monitoring device (10) prevents the drive (3) from acting on the moving element (2) at the latest after a predetermined waiting time has elapsed without actuating the drive (3) as such, - wherein either the control device (4) or the monitoring device (10) transmits a verification command (B) to the evaluation device (7) when a verification condition occurs, - wherein the evaluation device (7), in the event of a verification command (B) transmitted to it, transmits a respective special collision signal (C') to the control device (4) and the monitoring device (10) via the lines (8, 9) and - wherein, in the event of a failure to receive a special collision signal (C') expected on the basis of a verification command (B), the control device (4) immediately blocks movement of the moving element (2) at least in the current direction of travel, and the monitoring device (10) prevents the drive (3) from acting on the moving element (2) at the latest after the expiry of the predetermined waiting time without actuating the drive (3) as such, - wherein a normal collision signal (C) has a minimum duration (tmin) and a special collision signal (C') has a duration (t2) which is considerably shorter than the minimum duration (tmin). [2] Operating method according to claim 1, characterized bythat the evaluation device (7) is designed as a first-fault-safe evaluation device and that the test condition consists in the medical device (1) being in a special mode in which control of the drive (3) by the control device (4) is blocked. [3] Operating method according to claim 2, characterized by that the special operation consists in the fact that a power supply of the medical device (1) was switched on shortly beforehand or a command for a transition to special operation was given by a higher-level device. [4] Operating method according to claim 1, characterized by that the verification condition exists at the end of a predetermined monitoring period. [5] A medical device comprising a moving element (2), a drive (3) and a control device (4), wherein, in normal operation of the medical device, the control device (4) moves the moving element (2) in a controlled manner via the drive (3) when corresponding movement commands (V) are given to the control device (4), - wherein the medical device comprises an evaluation device (7), a monitoring device (10) different from the control device (4) and a first-fault-proof contact element (6) arranged on the medical device, in particular on the moving element (2), - wherein the evaluation device (7) for transmitting collision signals (C, C') is connected to the control device (4) and the monitoring device (10) via respective lines (8, 9), - wherein either the control device (4) or the monitoring device (10) is connected to the evaluation device (7) for transmitting a verification command (B) and - wherein the control device (4), the evaluation device (7) and the monitoring device (10) interact with one another according to an operating method according to claim 1. [6] Medical device according to claim 5, characterized by that the evaluation device (7) is designed as a fail-safe evaluation device and that the control device (4), the evaluation device (7) and the monitoring device (10) interact with one another according to an operating method according to claim 2 or 3. [7] Medical device according to claim 5, characterized by that the control device (4), the evaluation device (7) and the monitoring device (10) interact with one another according to an operating method according to claim 4.

Images