OPERATIONAL TABLE AND METHOD FOR CONTROLLING ACTUATORS IN AN OPERATIONAL TABLE

Description

Background of the invention

[0001] The present invention relates to an operating table having at least one component which is movable by an actuator, as well as a method for controlling actuators in an operating table.

[0002] Medical devices, such as ceiling mounts or operating tables, typically contain mechanical components that can be moved via an actuator when the user generates a function command via a data input interface. However, incorrect movement of these components poses a high safety risk to a patient or user of the medical device. Therefore, the actuator control is typically designed redundantly so that additional safety and control mechanisms can be implemented.

[0003] The control system is implemented electronically and typically contains one or more microcontrollers for processing the functional commands. Risk assessments lead to the implementation of measures to ensure that the actuators are controlled with first-fault safety. First-fault safety is typically achieved through hardware redundancies in the system. However, this increases the complexity and manufacturing costs of the medical device, as components and communication channels (bus) must be provided, tested, installed, and checked multiple times due to the redundancies.

[0004] The document US 2013 / 0069778 A1 describes a dialysis machine with a safety feature to assist and monitor the patient.

[0005] The document US 2011 / 0166512 A1 concerns a handheld device for injecting a medicine.

[0006] Document US 6,462,500 B1 relates to a control system for an operating table comprising a microphone (7) connected to a receiving block (9) and supplying audio signals to a discrimination block (11), which compares the speaker's voice profile with a specific authorized voice profile of a speaker. The voice profile is stored on a personal chip card (20) of the speaker. The authorized audio signals are processed in a speech recognition device and an electronic control unit, wherein one of the operating table's actuators (3) is selectively activated in response to a specific voice command spoken into the microphone and a pedal (16) operated by the speaker.

[0007] It is an object of the present invention to reduce the complexity and manufacturing costs of an operating table, while still ensuring reliable control of actuators of the operating table. Overview of the invention

[0008] The above-mentioned object is achieved by a ceiling mount according to claim 1, by an operating table according to claim 2, and by a method according to claim 11. However, the invention can also be applied to other medical devices. A medical device, such as an operating table or a ceiling mount, comprises at least one component that can be moved by an actuator. Furthermore, the device comprises a user interface via which a user can input an instruction for moving the component to a user interface microcontroller, and a control device designed to query data from the user interface microcontroller.The user interface microcontroller therefore does not need to be constantly active, but can be activated when the user enters an instruction. The control device can use a polling process to determine whether the user interface microcontroller is active and whether it has received an instruction from the user. The control device is further configured to authenticate the data received from the user interface microcontroller and, upon successful authentication, to control the actuator to move the component according to the user's instruction. This ensures that the actuators are only activated after verifying that both the control device and the user interface microcontroller are functioning correctly.

[0009] According to some embodiments, the control device may comprise a first and a second microcontroller, wherein the first microcontroller is configured to communicate with the user interface microcontroller, and the second microcontroller is configured to communicate with the first microcontroller. Thus, the second microcontroller does not require its own communication channel to the user interface microcontroller. Instead, the communication between the user interface and the control device can be controlled by the first microcontroller without causing collisions or contention on the communication channel, and without requiring a second communication channel between the control device and the user interface.

[0010] The second microcontroller can be configured to send a security query, a challenge, to the user interface microcontroller via the first microcontroller, and the first microcontroller can be configured to receive the response to the security query and forward the response to the second microcontroller. Thus, a challenge-response process can be performed between the second microcontroller and the user interface microcontroller without a direct communication channel existing between the second microcontroller and the user interface microcontroller. The first microcontroller preferably simply forwards both the challenge and the response without modifying or evaluating them.Further data from the user interface microcontroller, such as movement commands, can either be sent along with the response or can be sent separately from the user interface microcontroller to the first microcontroller, independent of authentication via the challenge-response method. According to some embodiments, the first microcontroller can be configured to issue a movement instruction to the actuator. The second microcontroller can further be configured to activate a power supply to the actuator. Thus, a movement of the component of the medical device by the actuator only occurs if both the first and second microcontrollers have identified the data received from the user interface microcontroller as a valid movement command.

[0011] According to some embodiments, the control device can query data from the user interface microcontroller at regular intervals. This eliminates the need for the user interface microcontroller to actively transmit data; instead, the communication channel between the control device and the user interface microcontroller can be controlled and operated from the control device.

[0012] According to some embodiments, a bus system can be provided between the control device and the user interface, which is designed such that data exchange between all elements of the control device and the user interface takes place via the bus system. Thus, only a single data line is required between the control device and the user interface. This simplifies the design of the medical device, particularly when the control device is arranged at a greater spatial distance from the user interface.

[0013] The control device is connected to a control unit of the actuator via two separate communication channels. The power supply for the actuator can be activated via a first communication channel, and movement commands can be transmitted to the actuator via a second communication channel. In a modular medical device, a separate actuator control unit can be provided for each module equipped with at least one actuator, which can then be connected to the central control unit of the medical device via the two communication channels. Alternatively, the control unit can be designed to directly control the power supply and the movement of the actuator.

[0014] According to some embodiments, the user interface can be connected to an operating element, wherein the operating element is configured to generate a first signal by means of which a power supply to the user interface microcontroller can be activated, and to generate a second signal corresponding to the instruction entered by the user to move the component of the medical device. Thus, the user interface microcontroller is only activated when the operating element is actually activated by a user, and a valid user input on the operating element can be detected, for example, via an additional capacitive sensor for generating the first signal.

[0015] It can be provided that the control element communicates with the user interface, and that the user interface evaluates signals from the control element and generates the first and second signals therefrom. In this case, for example, a single button press by a user can be evaluated by the user interface in such a way that both a first signal is generated, which activates a power supply to the user interface microcontroller, and a second signal is generated, which can then be evaluated by the activated user interface microcontroller as a movement command.

[0016] According to a further aspect, a method for controlling an actuator for moving at least one component of a medical device is provided, the method comprising receiving an instruction to move the component via a user interface at a user interface microcontroller and querying data from the user interface microcontroller by a control device. The data queried by the user interface microcontroller is then authenticated in the control device, and the actuator is controlled according to the instruction if the authentication in the control device is successful. Thus, the component of the medical device is only moved if the control device has verified that a valid movement command was entered by a user and that the user interface microcontroller is functioning correctly.

[0017] According to some embodiments, the authentication step may include sending a security challenge from a second microcontroller of the control device, via a first microcontroller of the control device, to the user interface microcontroller, sending a response to the security challenge along with a movement command from the user interface microcontroller to the first microcontroller, and sending the response from the first microcontroller to the second microcontroller. The response may then be verified by the second microcontroller to authenticate the movement command.Thus, communication between the control device and the user interface microcontroller can run entirely via the first microcontroller, yet a challenge-response process can be implemented between the second microcontroller and the user interface microcontroller, in which the respective challenge and response are simply forwarded by the first microcontroller without the first microcontroller further processing, evaluating, or modifying the corresponding data. Preferably, the first microcontroller also does not know the correct response to the second microcontroller's security query, so that in the event of a malfunction of the user interface microcontroller, a response from the first microcontroller cannot be falsely authenticated in the second microcontroller.

[0018] The step of controlling the actuator can include sending a movement instruction to the actuator by the first microcontroller and activating a power supply to the actuator by the second microcontroller. This ensures that the component of the medical device is only moved when both microcontrollers have verified the authenticity of the data received from the user interface microcontroller.

[0019] According to some embodiments, the control device can query the data of the user interface microcontroller at regular intervals, thus implementing a polling method. Short description of the drawings

[0020] Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, in which like reference numerals designate like or corresponding elements. Fig. 1 shows an exemplary operating table with controllable components in which the device and the method according to embodiments of the present invention can be used. Fig. 2 shows an exemplary ceiling mount with controllable components in which the device and the method according to embodiments of the present invention can be used. Fig. 3 shows a schematic overview of a control device according to a first embodiment of the present invention. Fig. 4 shows a schematic overview of a control device according to a second embodiment of the present invention. Fig. 5 shows a flowchart of a control method according to an embodiment of the present invention. Detailed description

[0021] In the following description, exemplary embodiments of the present invention are described with reference to the drawings. The drawings are not necessarily to scale, but are intended merely to schematically illustrate the respective features.

[0022] It should be noted that the features and components described below can each be combined with one another, regardless of whether they were described in connection with a single embodiment. The combination of features in the respective embodiments serves merely to illustrate the basic structure and functioning of the claimed device and method. Features described in connection with one embodiment of the device according to the invention can also be used in connection with the claimed method, and vice versa.

[0023] Fig. 1schematically shows an operating table 100 with a base 101 and a patient support surface 102. The patient support surface 102 comprises several components 103-106, such as back plates, head plates, leg plates, and the like. The components 101, 103-106 are movable by means of actuators to adjust the patient support surface 102 to a desired position. A user can enter commands to control the actuators via a control unit (not shown).

[0024] Fig. 2 schematically shows a ceiling mount 200 in which several arms 202, 203 are attached to a central unit 201, each of which can hold medical devices and move them to desired positions. The arms 202, 203 are movable by means of actuators, whereby a user can control the movement of the arms 202, 203 via a control unit, which can be attached, for example, to the central unit 201.

[0025] Fig. 3shows a first embodiment of the device 10 according to the invention. A user interface 11 is connected to a user interface board (UI processing board) 12, which in turn is connected to a control board 13 and a controller 14. The controller 14 provides the power supply and the movement commands for at least one actuator 15 of a medical device, such as an operating table 100 or a ceiling mount 200.

[0026] The user interface 11 can, for example, comprise one or more membrane switches, which on the one hand generate a first signal via a first contact, which can be implemented via a capacitive sensor 17, and wherein the user can, on the other hand, enter a selection signal for a desired function via an operating element 16, such as a key or button. According to one embodiment, the capacitive sensor 17 can comprise a switching membrane that is activated when touched or pressed. Alternatively, a capacitive sensor can be provided that is attached separately, comparable to a separate release switch. If the operating element 16 is designed as a membrane keyboard, each key can fulfill two functions, wherein the first signal can be generated when the membrane is pressed, and a function can be selected via the corresponding key.The membrane signal on the membrane keyboard only indicates that the control element 16 has been pressed at all and does not show which key was pressed, ie which function a user has selected.

[0027] Safety concept: if µC no longer has any power, it can no longer send incorrect commands The user interface board 12 comprises a user interface microcontroller (µC) 18, which receives and processes the inputs from the control element 16, and a power supply 19 for the user interface microcontroller 18. The power supply 19 receives input signals from the capacitive sensor 17 and / or from the control element 16 in order to supply the user interface microcontroller 18 with energy only when a user actuates the control element 16 or the first contact 17.

[0028] The user interface board 12 is connected to the control board 13 via a data and power supply line 21. Thus, in the embodiment shown, there is only one connection between the user interface board 12 and the control board 13 via a single bus system with corresponding interfaces 20, 22. Two further microcontrollers, µC1 and µC2, are provided on the control board 13, which are Fig. 3 are designated by reference numerals 23 and 24. Only the first microcontroller (µC1) 23 is connected to the bus system 20, 21, 22, and the second microcontroller (µC2) 24 communicates only indirectly with the user interface board 12 via the first microcontroller 23. The embodiment shown further includes at least one brake 25, which blocks the manual adjustment of elements that are not driven by an actuator 15.

[0029] At the Fig. 3In the first embodiment shown, the controller 14 is provided separately from the control board 13 and is connected to it via a first signal line 26 and a second power supply line 27. The first microcontroller 23 can output commands to the at least one actuator 15 via the signal line 26. The power supply of the actuator 15 is in turn switched on and off via a switch 28 of the controller 14, which is controlled by the second microcontroller 24. It can be provided that the second microcontroller 24 monitors the function of the switch 28 and the actuator 15 and, if necessary, sends test signals to the switch 28 and / or to the actuator 15.

[0030] Fig. 4 shows a second embodiment of the device 10 according to the invention. Fig. 4 The device 10 shown differs from that shown in Fig. 3The device shown is characterized in that the control 14 is integrated with the control board 13. Here, too, the at least one actuator 15 is controlled by the first microcontroller 23, and a power supply to the actuator 15 is activated or deactivated by the second microcontroller 24 via a switch 28.

[0031] The function of the Fig. 3 and 4 The devices shown are described below with reference to Fig. 5 described.

[0032] Fig. 5 shows a schematic representation of a method according to one embodiment. The Fig. 5 The procedure shown is divided into four aspects: A. Data entry B. Processing C. Receiving and implementing D. Generating movement

[0033] These aspects are discussed below with reference to the Fig. 3 and 4 shown elements of the control device are described: A. Data entry

[0034] According to one embodiment, in step S1, a user operation is received at the user interface via a capacitive sensor or the like. This can be the user pressing a release button or touching the membrane of a membrane keyboard. Subsequently, in step S2, a power supply to the user interface microcontroller 18 is switched on. The user interface microcontroller 18 then reads a movement command entered by the user via the user interface (step S4) in step S3. The movement command can be, for example, pressing a specific key on a membrane keyboard or actuating a switch or the like to select a specific movement and direction of movement. B. Processing

[0035] During processing, the user interface microcontroller 18 does not forward any commands on its own. Instead, the first microcontroller 23 on the control board 13 triggers each data transmission via the bus system 20, 21, 22 and cyclically polls the user interface microcontroller 18 for data ("polling" process, step S5). The first microcontroller 23 is always active, even when the user interface microcontroller 18 is turned off. The first microcontroller 23 determines the times between the individual polls of a user interface board 12. These times are in the millisecond range.

[0036] If the user interface microcontroller 18 is activated when a polling request from the first microcontroller 23 arrives, it sends a response to the polling request to the first microcontroller 23 in step S6. This response may already include the movement command entered by the user, but may also merely be a status indication of the user interface microcontroller 18. C. Receiving and implementing

[0037] When receiving and implementing the user commands requested by the first microcontroller 23, a second fuse is provided by the second microcontroller 24 on the control board 13. Fig. 5 In the embodiment shown, a challenge-response method is used.

[0038] For this purpose, the first microcontroller 23 can first activate the second microcontroller 24 in step S7, which, according to one embodiment, therefore does not need to be continuously supplied with power. Alternatively, the second microcontroller 24 can be permanently activated and, in step S7, only receives the command to generate a challenge. In step S9, the second microcontroller 24 sends the challenge to the first microcontroller 23, which itself knows neither the challenge nor the corresponding correct response, and thus only forwards the challenge to the user interface microcontroller 18 in step S10.

[0039] In step S11, the user interface microcontroller 18 generates the correct response to the security question, challenge, generated by the second microcontroller 24. Subsequently, in step S12, the first microcontroller 23 polls the user interface microcontroller 18 for the response. In response to the request from the first microcontroller 23, in step S13, the user interface microcontroller 18 sends the response to the first microcontroller 23, which cannot verify the response itself and forwards it unchanged to the second microcontroller 24 in step S14.

[0040] In step S15, the second microcontroller 24 checks the response generated by the user interface microcontroller 18. A correct response ensures that the user interface microcontroller 18 is powered on and functioning. If it is determined in step S16 that the response is valid, the second microcontroller 24 can inform the first microcontroller 23 in step S17 that the challenge-response process has been successfully completed and that the user interface microcontroller 18 is thus authenticated. If it is determined in step S16 that the response is invalid, the process is aborted in S18 and can be restarted, for example, by a new user input (step S1).

[0041] In parallel with the verification of the response by the second microcontroller 24, the first microcontroller 23 can request a movement command from the user interface microcontroller 18 in step S19 if the first microcontroller 23 has not already received the movement command, for example, in response to the first query in step S5 or to the query of the response in step S12. In this case, the user interface microcontroller 18 sends the movement command in step S20 in response to the corresponding request from the first microcontroller 23. The first microcontroller 23 can then check the movement command, for example, for plausibility, collision conditions, or the like, and can inform the second microcontroller 24 in step S21 that a valid movement command is present.

[0042] In the method described above, a situation may arise during a so-called lag time in which the user interface microcontroller 18 is still active even though the user no longer presses a button on the control element. In this case, the challenge-response method will still result in a correct response, but the first microcontroller 1 will not receive a valid movement command. During the mutual information exchange between the first and second microcontrollers 23, 24 in steps S17 and S21, it can thus be ensured that a movement is only generated if both a valid movement command is present and it has been ensured that the user interface microcontroller 18 is authenticated.In the embodiment shown, the presence of a valid response alone does not directly lead to, for example, the activation of the actuators' power supply, and the presence of a valid movement command alone also does not directly lead to this being sent to the actuators. Thus, even during the follow-up time, it can be ensured that the actuators are not mistakenly supplied with power or even moved due to a possibly no longer current movement command if the user interface microcontroller 18 is still active but the user has not entered any further commands. D. Create movement

[0043] Finally, to generate a movement of the actuators after the user interface microcontroller 18 has been authenticated and the movement command has been checked, in step S22 the second microcontroller 24 activates the power supply of the actuator(s), and in step S23 the first microcontroller 23 forwards the movement command to the control board 14, from which the actuators 15 are controlled.

[0044] In the method described above, only a single user interface microcontroller 18 is used. However, several different input devices can also be provided, each designed as an independent user interface and each having a separate, associated user interface microcontroller 18. The concept described above can also be scaled for applications where multiple user interface boards 12 are attached to the data bus of the control board 13, since each individual user interface board is only active as long as the user operates it.The indirect data transfer between the second microcontroller 24 and the user interface microcontroller 18 via the first microcontroller 23 has the advantage that the bus 20, 21, 22 can be controlled and clocked only by the first microcontroller 23, without other processors communicating over the same line. This simplifies synchronization and timing during data transfer, as no contention or collision can occur.

[0045] The above-described embodiments of the present invention thus ensure reliable control of actuators of the medical device, even without the hardware components involved in controlling the actuators having to be designed with complete redundancy. In particular, it is not necessary to provide a redundant communication line with corresponding redundant bus systems between a user interface and a control device, since, according to the above-described embodiments, a challenge-response method can be implemented even with a single data connection to check the error-free function of the user interface microcontroller 18 and the first microcontroller 23 of the control board 13 by means of a second microcontroller 24.This ensures that both the input of instructions by the user and the output of movement instructions by the first microcontroller 23 are carried out without errors.

Claims

1. A ceiling mount (200) having at least one component (202, 203) moveable by an actuator (15), comprising: a user interface (11, 12) via which a user can input, into a user interface microcontroller (18), an instruction to move the component (202, 203); and a controller (13) adapted to retrieve and authenticate data of the user interface microcontroller (18), and, upon successful authentication, control the actuator (15) to move the component (202, 203) according to the user's instruction, wherein the controller (13) is adapted to separately control the energy supply and the movement of the actuator (15).

2. An operating table (100) with a patient supporting surface (102) having at least one component (103-106) moveable by an actuator (15), comprising: a user interface (11, 12) via which a user can input, into a user interface microcontroller (18), an instruction to move the component (103-106); and a controller (13) adapted to retrieve and authenticate data of the user interface microcontroller (18), and, upon successful authentication, control the actuator (15) to move the component (103-106) according to the user's instruction, wherein the controller (13) is adapted to separately control the energy supply and the movement of the actuator (15).

3. The ceiling mount (200) according to claim 1 or the operating table (100) according to claim 2, wherein the controller (13) comprises first and second microcontrollers (23, 24), wherein the first microcontroller (23) is adapted to communicate with the user interface microcontroller (18), and wherein the second microcontroller (24) is adapted to communicate with the first microcontroller (23).

4. The ceiling mount (200) or the operating table (100) according to claim 3, wherein the second microcontroller (24) is adapted to send, via the first microcontroller (23), a challenge to the user interface microcontroller (18), and wherein the first microcontroller (23) is adapted to receive the response to the challenge, and to forward the response to the second microcontroller (24).

5. The ceiling mount (200) or the operating table (100) according to any one of claims 3 or 4, wherein the first microcontroller (23) is further adapted to output a moving instruction to an actuator (15), and wherein the second microcontroller (24) is further adapted to activate an energy supply of the actuator (15).

6. The ceiling mount (200) or the operating table (100) according to any one of the preceding claims, wherein the controller (13) retrieves data from the user interface microcontroller (18) at regular intervals.

7. The ceiling mount (200) or the operating table (100) according to any one of the preceding claims, wherein a bus system (20-22) is provided between the controller (13) and the user interface (11, 12) that is adapted such that data exchange between all elements of the controller (13) and the user interface (11, 12) is made via the bus system (20-22).

8. The ceiling mount (200) or the operating table (100) according to any one of the preceding claims, wherein the controller (13) is connected to a control (14) of the actuator (15) via two separate communication channels, wherein the energy supply for the actuator (15) is able to be activated via a first communication channel, and moving commands can be transmitted to the actuator (15) via a second communication channel.

9. The ceiling mount (200) or the operating table (100) according to any one of the preceding claims, wherein the user interface (11, 12) is connected to an operating element (16, 17), and wherein the operating element (16, 17) is adapted to generate a first signal by means of which an energy supply to the user interface microcontroller (18) is able to be activated, and to generate a second signal corresponding to the instruction to move the component (103-106, 202-203) of the operating table input by the user.

10. The ceiling mount (200) or the operating table (100) according to claim 9, wherein the operating element (16, 17) communicates with the user interface (11, 12), and wherein the user interface (11, 12) evaluates signals of the operating element (16, 17) and generates the first and second signals therefrom.

11. A method for controlling an actuator (15) to move at least one component (103-106, 202-203) of a ceiling mount (200) or a patient support surface (102) of an operating table (100), comprising: receiving (S1, S4) an instruction to move the component (103-106, 202-203) via a user interface (11, 12) on a user interface microcontroller (18); retrieving (S5, S6) data of the user interface microcontroller (18) by a controller (13); authenticating (S7-S15) the data retrieved from the user interface microcontroller (18) in the controller (13); and controlling (S22, S23) the actuator (15) according to the instruction if the authentication in the controller (13) is successful, wherein the controller (13) separately controls the energy supply and the movement of the actuator (15).

12. The method according to claim 11, wherein the step of authenticating comprises: sending (S9) a challenge from a second microcontroller (24) of the controller (13) to the user interface microcontroller (18) via a first microcontroller (23) of the controller (13); sending (S13) a response to the challenge from the user interface microcontroller (18) to the first microcontroller (23); sending (S14) the response from the first microcontroller (23) to the second microcontroller (24); and verifying (S15) the response by the second microcontroller (24) to authenticate the moving command, wherein the response, in particular, is sent in conjunction with a moving command from the user interface microcontroller (18) to the first microcontroller (23).

13. The method according to claim 12, wherein the step of controlling the actuator (15) comprises: sending (S23) a moving instruction from the first microcontroller (23) to the actuator (15); and activating (S22) an energy supply of the actuator (15) by the second microcontroller (24).

14. The method according to claims 11 to 13, wherein the controller (13) retrieves the data of the user interface microcontroller (18) at regular intervals.