Safety mechanism for a medical device

Abstract

A safety mechanism for a medical device (100) comprising a device body (10) and an attachable component (12) is provided. The safety mechanism comprising: an identification sensor (30) arranged to det

Description

Field The present disclosure relates to a safety mechanism for a medical device comprising a device body and an attachable component, as well as a corresponding medical device and a corresponding method. The medical device may specifically be a pump for a medical scoping device, such as a peristaltic pump. Background A number of medical devices have attachable components. For example, the attachable components could be elements of the device which need disposal or sterilisation once they have been used on a particular patient. Alternatively, they could be parts of the medical device which wear out sooner than the rest of the medical device. In which case, the ability to just replace those components is highly advantageous. However, when the attachable component is not attached to the rest of the medical device it can be important to ensure that the medical device is not operated. Operation of the medical device without the attachable component could be ineffective or even potentially create problems in the functioning of the device. Conventional systems have incorporated contact sensors to detect physical contact between the attachable component and the rest of the medical device. However, these can be easily overcome by having something else detected by the contact sensor. This could be deliberate to try and overcome the sensor and operate the device anyway, or inadvertent if a separate component is contacting the sensor without the operator realising. There is also a risk associated with incorrect attachable components being attached -including knock-offs produced by third parties. The original manufacturer cannot be sure that these third party attachable components meet the high standards of their original medical device. WO 2023 194735 A1 discloses, according to its abstract, a pump control unit for controlling a pump. The pump has a pump drive motor, a pump type identifier for identifying a pump type, and a pump speed rating identifier for identifying a pump speed rating. The pump control unit includes at least one controller configured to control an inverter for powering the pump drive motor; a pump type identification circuit and a pump speed rating identification circuit. The pump type identification circuit is configured to communicate with the pump type identifier to identify the pump type, the pump type identification circuit being configured to output a pump type identification signal for identifying the pump type. The pump speed rating identification circuit is configured to communicate with the pump speed rating identifier to identify the pump speed rating, the pump type identification circuit being configured to output a pump speed rating identification signal for identifying the pump speed rating. The controller has a cross-check circuit for receiving the pump type identification signal and the pump speed rating identification signal. The cross-check circuit is configured to identify a mismatch between the identified pump type and the identified pump speed rating. The cross-check circuit is configured to output a mismatch signal to inhibit operation of the pump in dependence on identification of the mismatch. Aspects also relate to a pump; and a method of controlling a pump. Two parameters are detected in this system. However, each of them are based on electrical connection between the corresponding identifier. Neither is less likely than the other to be incorrectly attached, or subject to interference or a bypass attempt. WO 2023 194735 A1 is of course not directly applicable or transferrable to a medical environment, since according to its background it is directed to pumping gasses in harsh operating environments. However, as explained above for medical devices the question of ensuring that attachable components are properly connected can be a critical one. There is therefore the need for an improved safety mechanism for a medical device. Summary A safety mechanism for a medical device comprising a device body and an attachable component is provided. The safety mechanism comprising: an identification sensor arranged to detect a presence of an identification tag, and generate an identification signal in response thereto; a presence sensor arranged to generate an attachment signal in response to the attachable component being attached to the device body; and a controller configured to: receive the identification signal from the identification sensor; receive the attachment signal from the presence sensor; and activate the medical device in response to the identification signal and the attachment signal both being received. This provides a safety mechanism which has two separate mechanisms for checking that the attachable component is properly attached before the medical device is activated. Detecting the presence of the identification tag may comprise: reading identification information from an identification tag of the attachable component; authenticating the identification information with respect to pre-determined criteria; and generating the identification signal in response to the identification information satisfying the predetermined criteria. This allows the system to check that the attachable component is the correct component. For example, that it is compatible with the medical device. The identification sensor may be further configured to: communicate with the identification tag, and generate a communication signal in response to the communication with the identification tag being completed. The communication signal shows that successful communication with the identification tag has been achieved. Communicating with the identification tag may comprise writing to the identification tag. Writing to the tag means that it is recorded that the attachable component has been used, or other information relating to the medical device. Writing to the identification tag may comprise writing usage data to the identification tag. Usage data can be important in order to ensure that the attachable component is not improperly used again when it should not be - for example if contamination is a risk. The controller may be further configured to: maintain activation of the medical device in response to continuing to receive the identification signal. This means that, for example, losing only the attachment signal does not stop operation of the device, which can help prevent unintended deactivation of the medical device. The controller may be further configured to: maintain activation of the medical device in response to continuing to receive the attachment signal. This means that, for example, losing only the identification signal does not stop operation of the device. The identification signal may be lost more easily than the attachment signal and so this prevents unintended deactivation of the medical device. The controller may be further configured to: deactivate the medical device in response to receiving neither of the identification signal and the attachment signal. Receiving neither of these signals can indicate that the attachable component has been de-attached, and so the medical device should be deactivated. The identification sensor may be configured to detect a presence of the identification tag via wireless communication. This means that physical interaction of the components is not necessary, helping to ensure that the attachable component can maintain a sterile environment. The identification sensor may comprise an RFID reader and / or an RFID reader / writer. These are effective wireless sensors for this application. The presence sensor may be a non-contact sensor, preferably a proximity sensor. This means that physical interaction of the components is not necessary, helping to ensure that the attachable component can maintain a sterile environment. The presence sensor may comprise one or more of: a magnetic sensor; an infra-red sensor; and / or an optical sensor. These are effective examples of sensors for the presence sensor. A medical device is provided. The medical device comprising the safety mechanism as discussed herein. This medical device takes advantage of the benefits discussed herein of the safety mechanism. The medical device may be a pump for a medical scoping device and the attachable component may be a pump head. Pump heads are commonly-used detachable components, and it is important to ensure that they are properly attached before operating the pump. A method for controlling a medical device comprising: a device body; and an attachable component is provided. The method comprising: detecting a presence of an identification tag, and generating an identification signal in response thereto; generating an attachment signal in response to the attachable component being attached to the device body; and activating the medical device in response to receiving both the identification signal and the attachment signal. This method helps ensure that the attachable component is properly attached before the medical device is activated. Detecting the presence of the identification tag may comprise: reading identification information from an identification tag of the attachable component; authenticating the identification information with respect to pre-determined criteria; and generating the identification signal in response to the identification information satisfying the predetermined criteria. This allows the method to check that the attachable component is the correct component. For example, that it is compatible with the medical device. The method may further comprise: communicating with the identification tag, and generating a communication signal in response to the communication with the identification tag being completed. The communication signal shows that successful communication with the identification tag has been achieved. Communicating with the identification tag may comprise writing to the identification tag. Writing to the tag means that it is recorded that the attachable component has been used, or other information relating to the medical device. Writing to the identification tag may comprise writing usage data to the identification tag. Usage data can be important in order to ensure that the attachable component is not improperly used again when it should not be - for example if contamination is a risk. The method may further comprise: maintaining activation of the medical device in response to continuing to receive the identification signal. This means that, for example, losing only the attachment signal does not stop operation of the device, which can help prevent unintended deactivation of the medical device. The method may further comprise: maintaining activation of the medical device in response to continuing to receive the attachment signal. This means that, for example, losing only the identification signal does not stop operation of the device. The identification signal may be lost more easily than the attachment signal and so this prevents unintended deactivation of the medical device. The method may further comprise: deactivating the medical device in response to receiving neither of the identification signal and the attachment signal. Receiving neither of these signals can indicate that the attachable component has been de-attached, and so the medical device should be deactivated. A further safety mechanism for a medical device comprising a device body and an attachable component is provided. The safety mechanism comprising: an identification sensor arranged to: detect a presence of an identification tag, and generate an identification signal in response thereto; and; communicate with the identification tag, and generate a communication signal in response to the communication with the identification tag being completed; and a controller configured to: receive the identification signal; receive the communication signal; and activate the medical device in response to the identification signal and the communication signal both being received. This safety mechanism ensures both that the tag is present, and that communication has been established therewith. This helps ensure that the attachable component is the correct component and is properly attached before the medical device is activated. Detecting the presence of the identification tag may comprise: reading identification information from an identification tag of the attachable component; authenticating the identification information with respect to pre-determined criteria; and generating the identification signal in response to the identification information satisfying the predetermined criteria. This allows the system to check that the attachable component is the correct component. For example, that it is compatible with the medical device. Communicating with the identification tag may comprise writing to the identification tag. Writing to the tag means that it is recorded that the attachable component has been used, or other information relating to the medical device. Writing to the identification tag may comprise writing usage data to the identification tag. Usage data can be important in order to ensure that the attachable component is not improperly used again when it should not be - for example if contamination is a risk. The controller may be further configured to: maintain activation of the medical device in response to continuing to receive the identification signal. This means that, for example, losing only the attachment signal does not stop operation of the device, which can help prevent unintended deactivation of the medical device. The safety mechanism may further comprise a presence sensor arranged to generate an attachment signal in response to the attachable component being attached to the device body. The presence sensor can provide a further confirmation of the attachable component being attached to the device body. The controller may be further configured to: maintain activation of the medical device in response to continuing to receive the attachment signal. This means that, for example, losing only the identification signal and / or the communication signal does not stop operation of the device. The identification signal and / or the communication signal may be lost more easily than the attachment signal and so this prevents unintended deactivation of the medical device. The controller may be further configured to: deactivate the medical device in response to receiving neither of the identification signal and the attachment signal. Receiving neither of these signals can indicate that the attachable component has been de-attached, and so the medical device should be deactivated. The identification sensor may comprise an RFID reader and / or an RFID reader / writer. These are effective wireless sensors for this application. The presence sensor may be a non-contact sensor, preferably a proximity sensor. This means that physical interaction of the components is not necessary, helping to ensure that the attachable component can maintain a sterile environment. The presence sensor may comprise one or more of: a magnetic sensor; an infra-red sensor; and / or an optical sensor. These are effective examples of sensors for the presence sensor. A further medical device is provided. The medical device comprising the further safety mechanism as discussed herein. This medical device takes advantage of the benefits discussed herein of the safety mechanism. The medical device may be a pump for a medical scoping device and the attachable component may be a pump head. Pump heads are commonly-used detachable components, and it is important to ensure that they are properly attached before operating the pump. A further method for controlling a medical device comprising: a device body; and an attachable component is provided. The method comprising: detecting a presence of an identification tag, and generating an identification signal in response thereto; communicating with the identification tag, and generating a communication signal in response to the communication with the identification tag being completed; and activating the medical device in response to receiving both the identification signal and the communication signal. This method ensures both that the tag is present, and that communication has been established therewith. This helps ensure that the attachable component is the correct component and is properly attached before the medical device is activated. Detecting the presence of the identification tag may comprise: reading identification information from an identification tag of the attachable component; authenticating the identification information with respect to pre-determined criteria; and generating the identification signal in response to the identification information satisfying the predetermined criteria. This allows the system to check that the attachable component is the correct component. For example, that it is compatible with the medical device. Communicating with the identification tag may comprise writing to the identification tag. Writing to the tag means that it is recorded that the attachable component has been used, or other information relating to the medical device. Writing to the identification tag may comprise writing usage data to the identification tag. Usage data can be important in order to ensure that the attachable component is not improperly used again when it should not be - for example if contamination is a risk. The method may further comprise: maintaining activation of the medical device in response to continuing to receive the identification signal. This means that, for example, losing only the attachment signal does not stop operation of the device, which can help prevent unintended deactivation of the medical device. The method may further comprise: generating an attachment signal in response to the attachable component being attached to the device body. This can provide a further confirmation of the attachable component being attached to the device body. The method may further comprise: maintaining activation of the medical device in response to continuing to receive the attachment signal. This means that, for example, losing only the identification signal and / or the communication signal does not stop operation of the device. The identification signal and / or the communication signal may be lost more easily than the attachment signal and so this prevents unintended deactivation of the medical device. The method may further comprise: deactivating the medical device in response to receiving neither of the identification signal and the attachment signal. Receiving neither of these signals can indicate that the attachable component has been de-attached, and so the medical device should be deactivated. Brief Description of the Drawings The present specification makes reference, by way of example only, to the accompanying Figures, in which: Figure 1 shows a perspective of a pump for a medical scoping device and an attachable pump head; Figures 2A and 2B show front and rear perspectives of an adaptor for an attachable component of a medical device; Figure 3 shows a schematic logic diagram of a first safety mechanism for a medical device; and Figure 4 shows a schematic logic diagram of a second safety mechanism for a medical device. Detailed Description Figure 1 shows an example medical device 100, which has an attachable component 12 which may be attached, for example to a device body 10. That is, the attachable component 12 may be attachable to the device body 10. Collectively, these can form the medical device 100. In certain cases, the device body 10 without the attachable component 12 attached can also (or alternatively) be identified as the medical device 100. The attachable component 12 could also be identified as an accessory 12. The device body 10 has a safety mechanism, formed of an identification sensor 30 a controller and a presence sensor (such as a non-contact sensor like a proximity sensor). In certain examples, such as those discussed in relation to Figure 4, the presence sensor may be an optional component. In the specific example of Figure 1, the medical device 100 is a pump 100 for a medical scoping device. This pump 100 having a pump body 10. The attachable component 12 then being a pump head 12. However, the present disclosure is equally applicable to any type of medical device 100. Medical scoping devices are generally well known, and encompass any or all of endoscopes, gastroscopes, colonoscopes, enteroscopes, sigmoidoscopes, panendoscopes, duodenoscopes, and bronchoscopes, but this list is non-exhaustive. Endoscopy involves inspecting the inside of a body lumen or cavity and includes procedures known as arthroscopy, cystoscopy, gastroscopy, uteroscopy and colonoscopy. Enteroscopy involves examination of the small intestine including the duodenum, jejunum and ileum. Such medical scoping devices are elongate flexible probes which may be inserted into the body directly or via a cannula or other guide device. Medical scoping devices can also include rigid surgical endoscopes or endotherapy devices such as biopsy forceps and polypectomy snares. Endoscopy involves inspecting the inside of a body lumen or cavity and includes procedures known as arthroscopy, cystoscopy, gastroscopy, uteroscopy and colonoscopy. Enteroscopy involves examination of the small intestine including the duodenum, jejunum and ileum. Such medical scoping devices are elongate flexible probes which may be inserted into the body directly or via a cannula or other guide device. Medical scoping devices can also include rigid surgical endoscopes or endotherapy devices such as biopsy forceps and polypectomy snares. For the example of a pump 100, this may specifically be a peristaltic pump 100. That is, a pump 100 which comprises a rotor with one or more independently rotatable rollers mounted thereon, and a track (sometimes called a shoe). In operation a flexible tube is positioned between the track and rotor. As the rotor rotates, each roller compresses the tube, pumping fluid along the tube. European Patent Publication No. EP 4 428 369 A1, the entire contents of which is hereby incorporated by reference, discloses an example of such a pump 100. The pump body 10 comprises a drive system 14 to drive the rotor with the pump head 12 engaged. The pump body 10 may also comprise controls for the pump 100. The pump body 10 shown in Figure 1 has a mount 11 for attaching the pump head 12 to. However, it is also the case that the mount 11 may be integral / unitary with the rest of the pump body 10 and not a separate component such as shown in Figure 1. The pump head 12 comprises a rotor with rollers mounted thereon, and a track. A spacing is defined between the track and the closest roller. The track is movably mounted on the pump head 12 for movement in and out of a working position. Thus, it can be moved between an open position in which the spacing is a maximum and a working position in which the spacing is a minimum. For example, the track may be movable upwardly away from the rotor to increase the spacing and downwardly towards the rotor to decrease the spacing, but other orientations may be used. In the open position the spacing is wide enough to permit a tube to be fitted to the pump head by positioning it between the track and rotor. In the working position, the track is resiliently biased towards the rotor, as discussed below, so that the tube is compressed between the track and the rollers to permit pumping of fluid through the tube as the rotor rotates. In this sense, the pump 100 can drive fluid flow without contacting the fluid, as is important in medical applications. As the pump head 12 wears, the mechanism for moving the track will degrade, which manifests as excess movement of the track relative to the rotor when the track is in the working position and the pump is in operation. This leads to a loss of pressure in the pumped fluid. Of course, other arrangements for the pump head 12 are equally possible. An identification tag 38 is provided on the attachable component 12. That is, a tag on which information can be stored for identifying the attachable component 12. The identification tag 38 may be read-only (i.e. it may not be possible to write new information to the tag). Alternatively, the identification tag 38 may be read-write in that new information can be written to the identification tag 38. For example, the identification tag 38 could be an RFID tag - such as a passive RFID tag. Of course, the identification tag 38 could be any other sort of tag including an active RFID tag, a near field communication (NFC) tag, a barcode (including a QR code), a magnetic strip, an infrared tag, etc.. In general, any wireless communication protocol could be used for the identification tag 38. The identification tag 38 may be substantially integral or unitary with the attachable component 12. Alternatively, the identification tag 38 may be attachable to the attachable component 12. Figure 1 shows an example where there is an adaptor 35 which attaches the identification tag 38 to the attachable component 12. This adaptor 35 can be used to retro-fit the identification tag 38 to an existing attachable component 12. Figures 2A and 2B show the adaptor 35 and identification tag 38 in font (Figure 2A) and rear (Figure 2B) isolated perspectives. As can be seen, the adaptor 35 may have one or more engagement members 38 for attaching the adaptor 35 to the attachable component 12. For example, in Figures 2A and 2B there are two engagement members 38 shown. These engagement member(s) 35 may be one or more projecting arms which are receivable in the attachable component 12. These projecting arms may be resiliently deformable during this attachment. The adaptor 35 further comprises a receiving section 37 for receiving the identification tag 38 therein. For example, in Figures 2A and 2B this is a slot or cavity which the identification tag 38 is inserted into. This adaptor 35 is attachable to the attachable component 12, such that the attachable component 12 comprises the identification tag 38. Returning to Figure 1, the safety mechanism comprises an identification sensor 30 which is configured to detect a presence of the identification tag 38. For example, the identification sensor 30 may be an RFID reader / writer 30. Of course, any suitable identification sensor 30 which is operable to perform the described operations with respect to the particular identification tag 38 can be used. The identification sensor 30 may be on the device body 10 of the medical device 100. It is appreciated that the identification sensor 30 may be formed of one or more separate individual sensors or components, which collectively perform the full functionality of the identification sensor 30. In use, with the attachable component 12 attached to the device body 10, the identification sensor 30 may be aligned with the identification tag 38. That is, the identification sensor 30 may be able to detect the presence of the identification tag 38. When the identification sensor 30 detects the presence of the identification tag 38, it generates an identification signal. In certain cases, such as that shown in Figure 4, the identification sensor 30 is also arranged to communicate with the identification tag 38. This could include a read operation and / or a write operation. When this communication is completed, a communication signal may be generated. It must be noted that in this regard, the identification sensor 30 may comprise one or more sub-sensors or sub-elements. For example, the identification to generate the identification signal may be performed by a first sub-sensor or sub-element, and the communication to generate the communication signal may be performed by a separate second sub-sensor or sub-element. Equally, these may both be performed by the same sensor. Specifically, this communication could be writing information to the identification tag 38. Once the information is written to the identification tag 38, the communication signal may be generated. For example, the information could include usage information of the medical device 100 and / or of the attachable component 12. For example, this could include one or more of: a count of the number of uses of the attachable components 12 and / or the medical device 100; a time of usage of the attachable components 12 and / or the medical device 100, or any other parameter relating to the usage of the attachable components 12 and / or the medical device 100. The safety mechanism comprises a presence sensor for detecting the presence of the attachable component 12 to the device body 10. Specifically, this could detect that the attachable component 12 has been attached to the device body 10. Again, the presence sensor may be arranged on the device body 10. Examples of the presence sensor could include a switch (such as a microswitch). In certain examples, the presence sensor may be a non-contact sensor - i.e. one that does not require physical contact with the attachable component 12. This could be a proximity sensor. For example, the presence sensor could comprise one or more of: a magnetic sensor; an infra-red sensor; and / or an optical sensor. This presence sensor generates an attachment signal in response to detecting the attachable component 12 being attached to the device body 10. The safety mechanism further comprises a controller (not shown), also referred to as a processor. This controller receives the identification signal from the identification sensor, and the attachment signal from the presence sensor. Operation of the controller in this respect will be described in detail with respect to Figure 3, but in brief the controller activates the medical device 100 in response to receiving both of the identification signal and the attachment signal. Again, this controller could be within the device body 10 of the medical device 100. The controller may control further operations of the medical device 100. The term “in response” as used throughout the specification means that when the condition occurs, the relevant signal is generated. In general, activation of the medical device 100 can be any operation which causes the medical device 100 to perform a function. For example, in the pump 100 example of Figure 1 this could be causing the pump 100 to start pumping a fluid. In certain cases, activation of the medical device 100 may mean that the medical device 100 is able to perform this function. That is, prior to activation it may not be possible to cause the medical device 100 to perform this function, and then after activation the medical device 100 can be caused to perform the function - for example by activating a user input. In any event, the medical device 100 can be discussed as being in an activated state. Receiving both the identification signal and the attachment signal may mean that these must both be received at exactly the same time (i.e. at a single moment in time, both are being received), or that they are received within a given time window or period of one another. This is applicable throughout the specification where receiving two or more signals is discussed. As long as the controller continues to receive the identification signal, the medical device 100 may be maintained in the activated state. That is, even if the attachment signal (or, where present, the communication signal) is lost. The controller may maintain the medical device 100 in the activated state as long as this attachment signal is received. Specifically, the controller may require both of the attachment signal and the identification signal to not be received, before it will deactivate the medical device 100. A deactivated state being the opposite of the activated state in that the medical device 100 no longer performs the function (or is no longer able to in response to a user input). In examples which also include the communication signal, this may particularly be relevant because the communication signal may drop off if the identification sensor 30 has a less than ideal connection. It may still be possible to generate the identification signal as the presence of the identification tag 38 is being detected, but the communication cannot be achieved. This could be caused, for example, by electromagnetic interference. Likewise, the identification signal may drop due to electromagnetic interference, but the attachment signal may still indicate that the attachable component 12 is attached to the medical device 100. Operation of a first safety mechanism in this sense will now be described with relation to the logic diagram of Figure 3. A logic diagram being a graphical representation of the operation of the controller. It is, of course, appreciated that a number of aspects of this functionality may be implemented in software and / or hardware (or the combination thereof). What is important is how the information is processed as opposed to the specific logical elements depicted. This is especially the case in relation to the depicted logic gates since different arrangements of gates can be used to perform the same processing. The logic diagram follows the standard practices relating to such diagrams, unless expressly recited to the contrary herein. In the present specification, generation of the respective signal is considered to correspond to a “high” input, and the respective signal not being generated is considered to correspond to a “low” input. 302a and 302b can correspond to the detection of the presence of the identification tag 38. In certain cases, both of these steps 302a, 302b may be necessary. However, in further cases only one may be required. At 302a the identification tag 38 is detected. For example, this could be that an RFID field is detected. In certain examples, this alone could correspond to detecting the presence of the identification tag 38. At 302b identification information is read from the identification tag 38 of the attachable component 12. This identification information is then authenticated with respect to predetermined criteria. For example, the pre-determined criteria could include identification information of a list of attachable components 12 which are compatible to form the medical device 100. For example, this could indicate whether the attachable component 12 is a legitimate attachable component 12 from the original manufacturer. In certain examples, such as shown in Figure 3, the identification signal may only be generated if the identification information satisfies the pre-determined criteria. The identification information may be encrypted, and the processor may decrypt the identification information as a part of the authentication. The identification signal may be sent to a first input of an AND gate 40. An AND gate 40 being a logic gate which outputs a high signal only when all of its inputs are “high”. As noted above, it is not necessary that a specific AND gate 40 is defined, but that the processor is configured to perform this functionality (in hardware and / or software). Optionally, this could require a communication step 304 to take place first. That is, the identification signal may only be sent to the AND gate 40 if the communication step 304 is successfully completed. This could also be referred to as a communication signal, which is only transmitted after successful completion of the communication step 304. In such cases, having detected the identification tag 38 (and where applicable authenticated the identification information), the communication step 304 takes place. As noted above, this could include writing to the identification tag 38. In certain examples, once this has been completed, the identification signal may be sent to the first input of the AND gate 40. In other examples, the identification signal may be sent to the first input of the AND gate 40 regardless of the status of this communication step. In certain examples, a separate communication signal may be generated once the communication step 304 has been completed. This communication signal can be sent to the first input of the AND gate 40 instead of the identification signal, and in this regard can effectively be denoted as an identification signal. The example of Figure 3 includes a presence sensor which generates an attachment signal when the attachable component 12 is attached to the device body 10 at 200, such as discussed herein. This attachment signal 200 is sent to a second input of the AND gate 40. Thus, the AND gate 40 must receive both the identification signal and the attachment signal before it outputs a high signal. The AND gate 40 outputting a high signal can be called a trigger signal. Identification Signal? Attachment Signal? Trigger Signal? No No No Yes No No No Yes No Yes Yes Yes Table 1: AND Gate 40 Truth Table This trigger signal can then be used to activate the medical device 100 such as discussed herein. In the examples of Figure 3, the trigger signal is output to a Set-Reset flip-flop 60 (also known as an SR flip-flop). Specifically, this is to a set input of the SR flip-flop 60. An SR flip-flop 60 is a bistable logical element. It has two inputs - a set input and a reset input, and an output. The set input being high triggers the output to be high. The output is then maintained high until the reset input is made high. The identification signal may be provided to the reset input. This could be directly or, as shown in Figure 3, via additional logic elements. Specifically, it could be an inverse of the identification signal provided to the reset input. An inverse being a low signal when the identification signal is high, and vice-versa. Thus, activation of the medical device 100 may be maintained until the identification signal 200 ceases being received. Again, the communication signal can be used in the place of the identification signal in this regard. In certain cases, the identification signal may be provided to the reset input regardless of whether the communication step 304 is successfully completed or not. In some of these cases, the identification signal may only be provided to the AND gate 40 if the communication step 304 is successfully completed. Additionally, or alternatively, the attachment signal 200 may also be provided to the reset input. Again, this could be directly or, as shown in Figure 3, via additional logic elements. Specifically, it could be an inverse of the attachment signal 200 provided to the reset input. An inverse being a low signal when the attachment signal is high, and vice-versa. Thus, activation of the medical device 100 may be maintained until the attachment signal 200 ceases being received. Figure 3 shows a specific example where the identification signal is provided as a first input to a NOR gate 50 and the attachment signal is provided as a second input to the NOR gate 50. A NOR gate 50 being a logic gate which outputs a high signal only when all of its inputs are low. The output of the NOR gate 50 can be designated a reset signal. As noted above, it is not necessary that a specific NOR gate 50 is defined, but that the processor is configured to perform this functionality (in hardware and / or software). For example, an OR gate could be provided with the same inputs, with its output then passed through a NOT gate. An OR gate being a logic gate which outputs a high signal when at least one of its inputs are high. A NOT gate being a logic gate which outputs high when its input is low, and low when its input is high. In this sense, a high signal is only sent to the reset pin if neither the identification signal nor the attachment signal are high. Identification Signal? Attachment Signal? Reset Signal? No No Yes Yes No No No Yes No Yes Yes No Table 2: NOR Gate 50 Truth Table It is appreciated that the same functionality in relation to the NOR gate 50 could be achieved in a number of different ways. For example, this could be by having a detachment signal which is generated when the attachable component 12 is detached from the body 10 (i.e. opposite to the attachment signal). An un-identification signal could be generated when the presence of the identification tag 38 is not detected (i.e. opposite to the identification signal). Each opposite signal could be generated by passing the original signal through a NOT gate. The detachment signal and the un-identification signal could then be provided as inputs to an AND gate, to achieve the same functionality as noted above. As explained herein, the logic diagram is provided to explain the functionality of the safety mechanism and any suitable implementation can be used. This is evidenced by the alternative discussed above. Therefore, to activate the medical device 100 both the identification signal and the attachment signal must be present. When they are, the medical device 100 is activated. The medical device 100 will continue being activated until both of the identification signal and the attachment signal are not present. One of these signals not being present will not be enough to deactivate the medical device 100. When both of the identification signal and the attachment signal are not present, the medical device 100 will be deactivated. In certain cases, the medical device 100 may incorporate double signal line protection. That is, there may be two (or more) independent pathways between one or more of the sensors discussed herein (including any individual sensor, and any combination of the sensors) and the controller. Additionally, or alternatively, there may be a plurality of individual sensors provided (which may be identical to one another) which collectively perform as any of the sensors discussed herein (including any individual sensor, and any combination of the sensors). Any of the sensors (including any individual sensor, and any combination of the sensors) discussed herein may be electrically isolated from the controller. For example, this could be via an opto-coupler (or opto-isolator). The SR flip-flop 60 can be implemented in a number of different ways. For example, this could comprise two cross-coupled NOR gates. The set signal being a first input to a first NOR gate, with the output of this NOR gate being a second input to a second NOR gate. The reset signal being a first input to the second NOR gate, with the output of the second NOR gate being a second input to the first NOR gate. The output of the second NOR gate is also the output of the SR flip-flop 60. Of course, other arrangements for the SR flip-flop 60 could be used. In certain examples, the communication signal could also be used in the activation of the medical device 100. That is, the communication signal could be provided as a third input to the AND gate 40. In which case, the identification signal, attachment signal, and communication signal may all need to be present for the trigger signal to be generated. Identification Signal? Attachment Signal? Communication Signal? Trigger Signal? No No No No Yes No No No Yes Yes No No Yes No Yes No No Yes Yes No No Yes No No No No Yes No Yes Yes Yes Yes Table 3: Modified AND Gate 40 Truth Table Equally, the communication signal could be provided as a third input to the NOR gate 50. However, if the identification signal is not generated then it is very likely that the 5 communication signal would also not be generated. There may, therefore, be little advantage in making such a change. Identification Signal? Attachment Signal? Communication Signal? Trigger Signal? No No No Yes Yes No No No Yes Yes No No Yes No Yes No No Yes Yes No No Yes No No No No Yes No Yes Yes Yes No Table 4: Modified NOR Gate 50 Truth Table 10 The various logic steps may be performed by the controller, as discussed herein. In further examples, the presence sensor may be optional. In such examples, the communication signal may be generated as discussed herein. In this context, the controller may receives the identification signal and the communication signal. Operation of the 15 controller will be described in detail with respect to Figure 4, but in brief the controller activates the medical device 100 in response to receiving both of the identification signal and the communication signal. Again, this controller could be within the device body 10 of the medical device 100. The controller may control further operations of the medical device 100. Receiving both the identification signal and the communication signal may mean that these must both be received at exactly the same time (i.e. at a single moment in time, both are being received), or that they are received within a given time window or period of one another. As long as the controller continues to receive the identification signal, the medical device 100 may be maintained in the activated state. That is, even if the attachment signal is lost. In these examples, the safety mechanism may further comprise a presence sensor for detecting the presence of the attachable component 12 to the device body 10. For example, this may be a non-contact sensor such as a proximity sensor. Specifically, this could detect that the attachable component 12 has been attached to the device body 10. Again, the presence sensor may be arranged on the device body 10. Examples of the presence sensor could include a switch (such as a microswitch). In certain examples, the presence sensor may be a non-contact sensor - i.e. one that does not require physical contact with the attachable component 12. This could be a proximity sensor. For example, this could comprise one or more of: a magnetic sensor; an infra-red sensor; and / or an optical sensor. This presence sensor generates an attachment signal in response to detecting the attachable component 12 being attached to the device body 10. The controller may also receive this attachment signal. The controller may maintain the medical device 100 in the activated state as long as this attachment signal is received. Specifically, the controller may require both of the attachment signal and the identification signal to not be received, before it will deactivate the medical device 100. A deactivated state being the opposite of the activated state in that the medical device 100 no longer performs the function (or is no longer able to in response to a user input). This may particularly be relevant because the communication signal may drop off if the identification sensor 30 has a less than ideal connection. It may still be possible to generate the identification signal as the presence of the identification tag 38 is being detected, but the communication cannot be achieved. This could be caused, for example, by electromagnetic interference. Operation of a second safety mechanism in this sense will now be described with relation to the logic diagram of Figure 4. Unless otherwise expressly stated to the contrary, any features of the logic diagram of Figure 3 are equally applicable to the logic diagram of Figure 4, and vice-versa. A logic diagram being a graphical representation of the operation of the controller. It is, of course, appreciated that a number of aspects of this functionality may be implemented in software and / or hardware (or the combination thereof). What is important is how the information is processed as opposed to the specific logical elements depicted. This is especially the case in relation to the depicted logic gates since different arrangements of gates can be used to perform the same processing. The logic diagram follows the standard practices relating to such diagrams, unless expressly recited to the contrary herein. In the present specification, generation of the respective signal is considered to correspond to a “high” input, and the respective signal not being generated is considered to correspond to a “low” input. 302a and 302b can correspond to the detection of the presence of the identification tag 38. In certain cases, both of these steps 302a, 302b may be necessary. However, in further cases only one may be required. At 302a the identification tag 38 is detected. For example, this could be that an RFID field is detected. In certain examples, this alone could correspond to detecting the presence of the identification tag 38. At 302b identification information is read from the identification tag 38 of the attachable component 12. This identification information is then authenticated with respect to predetermined criteria. For example, the pre-determined criteria could include identification information of a list of attachable components 12 which are compatible to form the medical device 100. For example, this could indicate whether the attachable component 12 is a legitimate attachable component 12 from the original manufacturer. In certain examples, such as shown in Figure 4, the identification signal may only be generated if the identification information satisfies the pre-determined criteria. The identification information may be encrypted, and the processor may decrypt the identification information as a part of the authentication. The identification signal may be sent to a first input of an AND gate 40. An AND gate 40 being a logic gate which outputs a high signal only when all of its inputs are “high”. As noted above, it is not necessary that a specific AND gate 40 is defined, but that the processor is configured to perform this functionality (in hardware and / or software). Having detected the identification tag 38 (and where applicable authenticated the identification information), the communication step 304 takes place. As noted above, this could include writing to the identification tag 38. Once this has been completed, a communication signal is generated and output from 304. This communication signal is sent to a second input of the AND gate 40. Thus, the AND gate 40 must receive both the identification signal and the communication signal before it outputs a high signal. The AND gate 40 outputting a high signal can be called a trigger signal. Identification Signal? Communication Signal? Trigger Signal? No No No Yes No No No Yes No Yes Yes Yes Table 5: AND Gate 40 Truth Table This trigger signal can then be used to activate the medical device 100 such as discussed herein. In the examples of Figure 4, the trigger signal is output to a Set-Reset flip-flop 60 (also known as an SR flip-flop). Specifically, this is to a set input of the SR flip-flop 60. An SR flip-flop 60 is a bistable logical element. It has two inputs - a set input and a reset input, and an output. The set input being high triggers the output to be high. The output is then maintained high until the reset input is made high. The identification signal may be provided to the reset input. This could be directly or, as shown in Figure 4, via additional logic elements. Specifically, it could be an inverse of the identification signal provided to the reset input. An inverse being a low signal when the identification signal is high, and vice-versa. In general, the communication signal may be lost as the ability to communicate with the identification tag 38 may be harder to maintain during operation of the medical device 100. Provided that the identification signal is still being generated, it may be desirable to maintain the activation of the medical device 100 despite the loss of the communication signal. The example of Figure 4 may further include a presence sensor (such as a non-contact sensor like a proximity sensor) which generates an attachment signal when the attachable component 12 is attached to the device body 10 at 200, such as discussed herein. This attachment signal 200 may also be provided to the reset input, such as shown in Figure 4. Again, this could be directly or, as shown in Figure 4, via additional logic elements. Specifically, it could be an inverse of the attachment signal 200 provided to the reset input. An inverse being a low signal when the attachment signal is high, and vice-versa. Figure 4 shows a specific example where the identification signal is provided as a first input to a NOR gate 50 and the attachment signal is provided as a second input to the NOR gate 50. A NOR gate 50 being a logic gate which outputs a high signal only when all of its inputs are low. The output of the NOR gate 50 can be designated a reset signal. As noted above, it is not necessary that a specific NOR gate 50 is defined, but that the processor is configured to perform this functionality (in hardware and / or software). For example, an OR gate could be provided with the same inputs, with its output then passed through a NOT gate. An OR gate being a logic gate which outputs a high signal when at least one of its inputs are high. A NOT gate being a logic gate which outputs high when its input is low, and low when its input is high. In this sense, a high signal is only sent to the reset pin if neither the identification signal nor the attachment signal are high. Identification Signal? Attachment Signal? Reset Signal? No No Yes Yes No No No Yes No Yes Yes No Table 6: NOR Gate 50 Truth Table It is appreciated that the same functionality in relation to the NOR gate 50 could be achieved in a number of different ways. For example, this could be by having a detachment signal which is generated when the attachable component 12 is detached from the body 10 (i.e. opposite to the attachment signal). An un-identification signal could be generated when the presence of the identification tag 38 is not detected (i.e. opposite to the identification signal). Each opposite signal could be generated by passing the original signal through a NOT gate. The detachment signal and the un-identification signal could then be provided as inputs to an AND gate, to achieve the same functionality as noted above. As explained herein, the logic diagram is provided to explain the functionality of the safety mechanism and any suitable implementation can be used. This is evidenced by the alternative discussed above. Therefore, to activate the medical device 100 both the identification signal and the communication signal must be present. When they are, the medical device 100 is activated. The medical device 100 will continue being activated until both of the identification signal and the attachment signal are not present. One of these signals not being present will not be enough to deactivate the medical device 100. When both of the identification signal and the attachment signal are not present, the medical device 100 will be deactivated. In certain cases, the medical device 100 may incorporate double signal line protection. That is, there may be two (or more) independent pathways between one or more of the sensors discussed herein (including any individual sensor, and any combination of the sensors) and the controller. Additionally, or alternatively, there may be a plurality of individual sensors provided (which may be identical to one another) which collectively perform as any of the sensors discussed herein (including any individual sensor, and any combination of the sensors). Any of the sensors (including any individual sensor, and any combination of the sensors) discussed herein may be electrically isolated from the controller. For example, this could be via an opto-coupler (or opto-isolator). The SR flip-flop 60 can be implemented in a number of different ways. For example, this could comprise two cross-coupled NOR gates. The set signal being a first input to a first NOR gate, with the output of this NOR gate being a second input to a second NOR gate. The reset signal being a first input to the second NOR gate, with the output of the second NOR gate being a second input to the first NOR gate. The output of the second NOR gate is also the output of the SR flip-flop 60. Of course, other arrangements for the SR flip-flop 60 could be used. In certain examples, the attachment signal could also be used in the activation of the medical device 100. That is, the attachment signal could be provided as a third input to the AND gate 40. In which case, the identification signal, communication signal, and attachment signal may all need to be present for the trigger signal to be generated. Identification Signal? Communication Signal? Attachment Signal? Trigger Signal? No No No No Yes No No No Yes Yes No No Yes No Yes No No Yes Yes No No Yes No No No No Yes No Yes Yes Yes Yes Table 7: Modified AND Gate 40 Truth Table Equally, the communication signal could be provided as a third input to the NOR gate 50. However, if the identification signal is not generated then it is very likely that the 5 communication signal would also not be generated. There may, therefore, be little advantage in making such a change. Identification Signal? Attachment Signal? Communication Signal? Trigger Signal? No No No Yes Yes No No No Yes Yes No No Yes No Yes No No Yes Yes No No Yes No No No No Yes No Yes Yes Yes No Table 8: Modified NOR Gate 50 Truth Table 10 The various logic steps may be performed by the controller, as discussed herein. In this sense, various safety mechanisms for a medical device 100 are provided, as well as corresponding methods. The medical device 100 was broadly discussed in relation to Figures 1,2A and 2B. The controller discussed in relation thereto can implement the logic diagrams discussed herein, and any of the method steps or complete methods as discussed herein. A first method is for controlling a medical device 100 with an attachable component 12. Specifically, this can be the medical device 100 as discussed herein. The method comprises: first detecting a presence of an identification tag 38, and generating an identification signal in response thereto. This can be with the identification sensor 30 as discussed herein. Then, the method comprises: generating an attachment signal in response to the attachable component being attached to the device body. Finally, the method comprises: activating the medical device 100 in response to receiving both the identification signal and the attachment signal. Activation of the medical device 100 may be maintained in response to continuing to receive: the identification signal; and / or the attachment signal. In other words, the method may comprise deactivating the medical device in response to receiving neither of the identification signal and the attachment signal. A further method for controlling a medical device 100 with an attachable component 12 is also provided. Unless otherwise expressly stated to the contrary, any aspects of the first method are equally applicable to the further method, and vice-versa. Specifically, this can be the medical device 100 as discussed herein. Th method comprises: first detecting a presence of an identification tag 38, and generating an identification signal in response thereto. This can be with the identification sensor 30 as discussed herein. Then, the method comprises: communicating with the identification tag 38, and generating a communication signal in response to the communication with the identification tag 38 being completed. This does not necessarily mean that all of the communication is complete, but that at least enough of the communication is complete for operation of the medical device 100 to continue. Finally, the method comprises: activating the medical device 100 in response to receiving both the identification signal and the communication signal. The various modifications discussed herein in relation to the medical device 100 of Figures 1,2A and 2B, and the logic diagrams of Figures 3 and 4 can be applied to either method. For example, any of the discussed signals may be generated using the corresponding sensor as discussed herein. This includes any of the sensors in isolation from the other sensors discussed herein, or any combination of two or more of the sensors discussed herein, including all of the sensors discussed herein. Improved safety mechanisms for a medical device 100, medical devices 100, and corresponding methods are therefore provided. As noted above, one example of the medical device 100 is a pump 100 for a medical scoping device. Further examples of other applications include radiofrequency generators, electrosurgical generators, ultrasonic generators, and gas-supplying units (such as CO2 regulation units). A radiofrequency generator is a device used to produce electromagnetic waves in the radiofrequency range. This can be used, for example, in cauterization or ablation treatments. An electrosurgical generator is a device used to generate high-frequency electrical currents. These can then be used to perform, for example, cutting, desiccation, and coagulation. An ultrasonic generator is a device used to produce ultrasonic vibrational energy. This can be used, for example, in dissection, cutting, sealing vessels, or securing haemostasis. Gas-supplying units control and / or regulate a supply of gas. For example, this could be an insufflator which delivers a gas into a patient’s abdomen in order to inflate this area to provide space for a medical professional - such as in laparoscopy. This could, for example be a CO2 insufflator and / or CO2 regulation unit. CLAUSES: 1. A safety mechanism for a medical device comprising a device body and an attachable component, the safety mechanism comprising: an identification sensor arranged to: detect a presence of an identification tag, and generate an identification signal in response thereto; and; communicate with the identification tag, and generate a communication signal in response to the communication with the identification tag being completed; and a controller configured to: receive the identification signal; receive the communication signal; and activate the medical device in response to the identification signal and the communication signal both being received. 2. The safety mechanism of clause 1, wherein the detecting the presence of the identification tag comprises: reading identification information from an identification tag of the attachable component; authenticating the identification information with respect to pre-determined criteria; and generating the identification signal in response to the identification information satisfying the pre-determined criteria. 3. The safety mechanism of any preceding clause, wherein communicating with the identification tag comprises writing to the identification tag. 4. The safety mechanism of clause 3, wherein writing to the identification tag comprises writing usage data to the identification tag. 5. The safety mechanism of any preceding clause, wherein the controller is further configured to: maintain activation of the medical device in response to continuing to receive the identification signal. 6. The safety mechanism of any preceding clause, further comprising a presence sensor arranged to generate an attachment signal in response to the attachable component being attached to the device body. 7. The safety mechanism of clause 6, wherein the controller is further configured to: maintain activation of the medical device in response to continuing to receive the attachment signal. 8. The safety mechanism of any of clauses 6 to 7, wherein the controller is further configured to: deactivate the medical device in response to receiving neither of the identification signal and the attachment signal. 9. The safety mechanism of any preceding clause, wherein the identification sensor comprises an RFID reader and / or an RFID reader / writer. 10. The safety mechanism of any preceding clause, wherein the presence sensor is a non-contact sensor, preferably a proximity sensor. 11. The safety mechanism of any preceding clause, wherein the presence sensor comprises one or more of: a magnetic sensor; an infra-red sensor; and / or an optical sensor. 12. A medical device comprising the safety mechanism of any preceding clause. 13. The medical device of clause 12, wherein the medical device is a pump for a medical scoping device and the attachable component is a pump head. 14. A method for controlling a medical device comprising: a device body; and an attachable component, the method comprising: detecting a presence of an identification tag, and generating an identification signal in response thereto; communicating with the identification tag, and generating a communication signal in response to the communication with the identification tag being completed; and activating the medical device in response to receiving both the identification signal and the communication signal. 15. The method of clause 14, wherein detecting the presence of the identification tag comprises: reading identification information from an identification tag of the attachable component; authenticating the identification information with respect to pre-determined criteria; and generating the identification signal in response to the identification information satisfying the pre-determined criteria. 16. The method of any of clauses 14 to 15, wherein communicating with the identification tag comprises writing to the identification tag. 17. The method of clause 16, wherein writing to the identification tag comprises writing usage data to the identification tag. 18. The method of any of clauses 14 to 17, further comprising: maintaining activation of the medical device in response to continuing to receive the identification signal. 19. The method of any of clauses 14 to 18, further comprising: generating an attachment signal in response to the attachable component being attached to the device body. 20. The method of clause 19, further comprising: maintaining activation of the medical device in response to continuing to receive the attachment signal. 21. The method of any of clauses 19 to 20, further comprising: deactivating the medical device in response to receiving neither of the identification signal and the attachment signal.

Claims

:

1. A safety mechanism for a medical device comprising a device body and an attachable component, the safety mechanism comprising:an identification sensor arranged to detect a presence of an identification tag, and5 generate an identification signal in response thereto;a presence sensor arranged to generate an attachment signal in response to the attachable component being attached to the device body; anda controller configured to:receive the identification signal from the identification sensor;10 receive the attachment signal from the presence sensor;activate the medical device in response to the identification signal and the attachment signal both being received;maintain activation of the medical device in response to continuing to receive the identification signal;15 maintain activation of the medical device in response to continuing toreceive the attachment signal; anddeactivate the medical device in response to receiving neither of the identification signal and the attachment signal.20 2. The safety mechanism of claim 1, wherein the detecting the presence of theidentification tag comprises:reading identification information from an identification tag of the attachable component;authenticating the identification information with respect to pre-determined criteria;25 andgenerating the identification signal in response to the identification information satisfying the pre-determined criteria.

3. The safety mechanism of any preceding claim, wherein the identification sensor is 30 further configured to: communicate with the identification tag, and generate a communication signal in response to the communication with the identification tag being completed.

4. The safety mechanism of claim 3, wherein communicating with the identification tag 35 comprises writing to the identification tag.14 11 255. The safety mechanism of claim 4, wherein writing to the identification tag comprises writing usage data to the identification tag.5 6. The safety mechanism of any preceding claim, wherein the identification sensor isconfigured to detect a presence of the identification tag via wireless communication.

7. The safety mechanism of any preceding claim, wherein the identification sensor comprises an RFID reader and / or an RFID reader / writer.

108. The safety mechanism of any preceding claim, wherein the presence sensor is a non-contact sensor, preferably a proximity sensor.

9. The safety mechanism of any preceding claim, wherein the presence sensor15 comprises one or more of:a magnetic sensor;an infra-red sensor; and / oran optical sensor.20 10. A medical device comprising the safety mechanism of any preceding claim.

11. The medical device of claim 10, wherein the medical device is a pump for a medical scoping device and the attachable component is a pump head.25 12. A method for controlling a medical device comprising: a device body; and anattachable component, the method comprising:detecting a presence of an identification tag, and generating an identification signal in response thereto;generating an attachment signal in response to the attachable component being30 attached to the device body;activating the medical device in response to receiving both the identification signal and the attachment signal;maintaining activation of the medical device in response to continuing to receive the identification signal;14 11 25maintaining activation of the medical device in response to continuing to receive the attachment signal; anddeactivating the medical device in response to receiving neither of the identification signal and the attachment signal.

513. The method of claim 12, wherein detecting the presence of the identification tag comprises:reading identification information from an identification tag of the attachable component;10 authenticating the identification information with respect to pre-determined criteria;andgenerating the identification signal in response to the identification information satisfying the pre-determined criteria.15 14. The method of any of claims 12 to 13, further comprising: communicating with theidentification tag, and generating a communication signal in response to the communication with the identification tag being completed.

15. The method of claim 14, wherein communicating with the identification tag20 comprises writing to the identification tag, preferably writing usage data to the identification tag.25s

Images