A safe healthcare system

Abstract

A novel medical system for transferring fluid to and / or from a patient or for delivering treatment to a patient is provided. This document discloses several embodiments configured to ensure the safety of medical systems.

Description

[Technical field]

[0001] The present invention relates to a system for safely delivering treatments, such as, but not limited to, dialysis treatments. [Background technology]

[0002] A healthcare system must provide treatment to a patient in a secure or safe manner. Risks can come from hardware or software. Therefore, healthcare systems may include a safety architecture. Some healthcare systems include safeguards, such as monitoring or redundant devices, to ensure the safety of patients during treatment.

[0003] WO2016094860 relates to a valved manifold module configured to receive a group of four substantially identical valve assemblies, which are controlled by a local controller attached to the manifold module.

[0004] US Pat. No. 5,551,850 relates to a medical infusion pump for intravenous administration of medical fluids, controlled by two microprocessors including a monitor microprocessor and a control microprocessor.

[0005] WO2010027437 relates to a dialysis system comprising a dialysis unit, a user interface, a first processing unit dedicated to the dialysis unit, and a second processing unit dedicated to the user interface.

[0006] WO2019204195 relates to a medical system configured to provide peritoneal dialysis treatment to a patient, the medical system having two independent computers for separating safety-critical and non-safety-critical functions.

[0007] U.S. Patent Application Publication No. 2003220598 relates to an automated peritoneal dialysis system that includes a main processor configured to perform certain high-level tasks, several delegate processors configured to perform lower-level tasks, and an additional processor dedicated to tracking safety parameters.

[0008] US Patent Application Publication No. 2020046990 relates to a portable medical system that includes a general-purpose processor, a critical-purpose processor, and a watchdog component that monitors the operation of the general-purpose processor and the critical-purpose processor.

[0009] WO2008069897 relates to a medical device including an intermediate device and a clinician programmer, each having its own computing unit module with a processor, the medical device further including a system watchdog module having a software task running on the intermediate device to monitor the behavior of the clinician programmer.

[0010] However, such safety devices can be expensive and / or difficult to manage.

[0011] This disclosure describes several features that are inexpensive and easy to implement or use. Summary of the Invention

[0012] This Summary is provided to introduce in a simplified form selected disclosure material that is further described below in the Detailed Description. This Summary is not intended to necessarily identify key features or essential features of the claimed subject matter, nor is it intended as an aid in determining the scope of the claimed subject matter.

[0013] This document describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid pathway in fluid communication with a body of a patient; a first group of occlusion devices and a second group of occlusion devices configured to occlude a fluid pathway (e.g., at different locations and / or on different fluid lines, etc.); a first processor operatively connected to the first group of occlusion device actuators to open and close at least one occlusion device of the first group of occlusion devices; a second processor operatively connected to the second group of occlusion device actuators to open and close at least one occlusion device of the second group of occlusion devices; a pump configured to move fluid through the fluid path; A medical system is disclosed that includes: a first group of at least one occlusion device and a second group of at least one occlusion device may be disposed upstream of a pump, and a first group of at least one occlusion device and a second group of at least one occlusion device may be disposed downstream of the pump.

[0014] This document also describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid pathway in fluid communication with a body of a patient; a first group of occlusion devices and a second group of occlusion devices configured to occlude a fluid pathway (e.g., at different locations and / or on different fluid lines); a first processor operatively coupled to a first group of occlusion devices; a second processor operatively coupled to the second group of occlusion devices; a pump configured to move fluid through the fluid path; A medical system is disclosed that includes: a first group of at least one occlusion device and a second group of at least one occlusion device may be disposed upstream of a pump, and a first group of at least one occlusion device and a second group of at least one occlusion device may be disposed downstream of the pump.

[0015] This document also describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid pathway in fluid communication with a patient's body, the fluid pathway including a first bag and a second bag; a first group of occlusion devices and a second group of occlusion devices configured to occlude a fluid pathway (e.g., at different locations or on different fluid lines); a first processor operatively coupled to a first group of occlusion devices; a second processor operatively coupled to the second group of occlusion devices; A first group of occlusion devices and a second group of occlusion devices may be positioned to occlude a fluid path between a first bag and a patient and to occlude a fluid path between a second bag and the patient.

[0016] This document also describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid pathway in fluid communication with a patient's body, the fluid pathway including a first bag and a second bag; a first group of occlusion devices and a second group of occlusion devices configured to occlude a fluid pathway (e.g., at different locations or on different fluid lines); a first processor operatively coupled to a first group of occlusion devices; a second processor operatively coupled to the second group of occlusion devices; a pump configured to move fluid through the fluid path; A first group of occlusion devices and a second group of occlusion devices may be positioned to occlude a fluid path between a first bag and a patient and to occlude a fluid path between a second bag and the patient.

[0017] This document also describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid pathway including a patient line, a fill line, and a drain line; a first group of occlusion devices and a second group of occlusion devices configured to occlude a fluid pathway (e.g., at different locations or on different fluid lines); a first processor operatively coupled to a first group of occlusion devices; a second processor operatively coupled to the second group of occlusion devices; a pump configured to move fluid through the fluid path; A medical system is disclosed that includes a first group of occlusion devices and a second group of occlusion devices that may be positioned to occlude a fluid path between a fill line and a patient line and to occlude a fluid path between a drain line and a patient line.

[0018] This document also describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid pathway including a patient line, a fill line, and a drain line; a first group of occlusion devices and a second group of occlusion devices configured to occlude a fluid pathway (e.g., at different locations or on different fluid lines); a first processor operatively coupled to a first group of occlusion devices; a second processor operatively coupled to the second group of occlusion devices; a pump configured to move fluid through the fluid path; A medical system is disclosed, comprising: a first group of occlusion devices may include at least two occlusion devices arranged to be capable of occluding the patient line from the fill line and the drain line, respectively; and a second group of occlusion devices may include at least two occlusion devices arranged to be capable of occluding the patient line from the fill line and the drain line, respectively.

[0019] This document also describes a medical system for transferring fluid to and / or from a patient, comprising: a fluid path including a patient line, a fill line having a dialysate bag, and a drain line having a drain bag; a first group of occlusion devices and a second group of occlusion devices each including at least two occlusion devices configured to occlude a fluid pathway (e.g., at different locations or on different fluid lines); a first processor operatively coupled to a first group of occlusion devices; a second processor operatively coupled to the second group of occlusion devices; a pump configured to move fluid through the fluid path; The medical system includes a first group of occlusion devices and a second group of occlusion devices may be arranged to occlude the fluid paths between the dialysate bag and the patient, and to occlude the fluid paths between the drain bag and the patient, such that if one of the two processors is faulted or fails, the other processor can control the occlusion devices to occlude the fluid paths between the patient and the drain bag and between the patient and the dialysate bag.

[0020] All of the above aspects of the disclosure may include the following optional features.

[0021] According to various embodiments, the medical system may be a dialysis system, e.g., a peritoneal dialysis system, or other similar medical system, e.g., a hemodialysis system, etc. The medical system may further include a fill line, which may have a dialysate bag, a drain line, which may have a drain bag, and a patient line, which may be connected or designed to be connected to a patient's body, e.g., the patient's peritoneal cavity or another part of the patient's body. A first occlusion device of the first group (e.g., a first occlusion device of the at least two occlusion devices) may be disposed on the fill line. A first occlusion device of the second group (e.g., a first occlusion device of the at least two occlusion devices) may be disposed on the drain line.

[0022] According to various embodiments, the pump may be configured to move fluid from the fill line to the patient line and / or from the patient line to the drain line. The pump may include a peristaltic pump. The pump may include a rotary motor, and the fluid pathway and pump may be arranged to allow unidirectional rotation of the rotary motor of the pump to move fluid from the fill line to the patient line and / or from the patient line to the drain line. The pump may include an inlet port connected to the fill line and the patient line. The pump may include a single inlet port connected to the fill line and the patient line. The pump may include an outlet port connected to the drain line and the patient line. The pump may include a single outlet port connected to the drain line and the patient line. The patient line may include a fluid connection to the inlet port and the outlet port. The inlet port and the outlet port may be separate from one another. The patient line or a portion of the patient line connected (or fluidly connected) to the inlet port may include a second occlusion device of a second group of at least two occlusion devices. The patient line or portion of the patient line connected (or fluidly connected) to the outlet port may include a second occlusion device of the first group of at least two occlusion devices. The fill line may be connected only to the inlet port. The drain line may be connected only to the outlet port.

[0023] According to various embodiments, at least one of the occlusion devices may include an actuator connected to a dedicated processor, and the actuators of the first group may be powered by a power source different from the power source of the actuators of the second group.

[0024] The advantages of this system are: · If one of the two processors is disabled or fails, the other processor can still control the occlusion device(s) to keep the patient safe. Two separate processors ensure patient safety. Patient safety can be ensured in two separate ways; and / or · Each occlusion device opens and closes its own fluid line and / or is controlled by a single processor, so redundant devices are not required while still ensuring patient safety.

[0025] This document also provides a watchdog system for a medical system, comprising: a first (e.g. main) control unit of the medical system including an operating system and medical applications; a second control unit of the medical system; an electronic monitoring circuit configured to be able to detect a failure of at least one of the first control unit and the second control unit; The first control unit, the second control unit, and the electronic monitoring circuitry may be operatively coupled, for example by a wired connection.

[0026] The second control unit may be configured to define, generate, create, start or initiate a time window (also referred to as a trigger window) during which the first control unit should send a signal to the electronic monitoring circuit. The second control unit may be configured to send a signal related to the time window to at least one of the first control unit and the electronic monitoring circuit. The signal related to the time window may include a start signal and / or an end signal. The signal may include a toggle up and / or a toggle down.

[0027] The first (e.g., main) control unit may be configured to send a signal to the electronic monitoring circuitry in response to a signal related to the time window. The signal may include toggling up and / or toggling down. The electronic monitoring circuitry may be configured to receive a signal related to the time window of the second control unit and a signal of the first control unit. The electronic monitoring circuitry may be configured to receive a signal related to the time window sent by the second control unit and a signal sent by the first control unit. Based on the signal received by the electronic monitoring circuitry, the electronic monitoring circuitry may be configured to output a fault signal. The signal may include toggling up and / or toggling down.

[0028] The first (e.g., main) control unit may be configured to send its signal (to the electronic monitoring circuit) during a time window. If the electronic monitoring circuit receives the first control unit's signal outside the time window, the electronic monitoring circuit may be configured to output a fault signal and / or determine a fault. If the electronic monitoring circuit does not receive the first control unit's signal during the time window, the electronic monitoring circuit may be configured to output a fault signal and / or determine a fault. If the first control unit does not send a signal (to the electronic monitoring circuit) during the time window, the electronic monitoring circuit may be configured to output a fault signal and / or determine a fault.

[0029] The watchdog system for a medical system may further include a third control unit operatively coupled to at least one of the first (e.g., main) control unit, the second control unit, and the electronic monitoring circuit. The second control unit may be configured to send a signal related to the time window to the third control unit. The third control unit may be configured to receive or read or monitor the signal related to the time window sent by the second control unit. The third control unit may be configured to compare the signal related to the time window with a predetermined signal. The third control unit may be configured to output a fault signal based on the received signal, for example based only on the signal related to the time window and the predetermined signal.

[0030] The watchdog system a first communication line configured to provide a connection between the first control unit and the second control unit; a second communication line configured to provide a connection between the first (e.g., main) control unit and the electronic monitoring circuit; a third communication line configured to provide a connection between the second control unit and the electronic monitoring circuit; may include at least one of the following:

[0031] The second control unit may be configured to send the time window to the first control unit and the electronic monitoring circuitry via the first and third communication lines, respectively. The first and third communication lines may be capable of electronic communication. The first control unit may be configured to send a signal to the electronic monitoring circuitry via the second communication line.

[0032] The operating system may be a third-party operating system and / or may not be a real-time operating system. The operating system may include SOftware of Unknown Provenance (SOUP), off-the-shelf software (OTS), and / or commercial off-the-shelf software (COTS). The operating system may be configured to support medical applications. The first (e.g., main) control unit may be configured to execute protection software for the medical applications.

[0033] The first control unit may synchronize the signal with (or according to) the time window in order to send the signal during a period defined by the time window. The synchronization may be performed for each time window received by the first control unit, or only once.

[0034] According to various embodiments, the electronic monitoring circuit may include a logic circuit configured to output a fault signal based on a logic operation result of the signal of the first (e.g., main) control unit and a time window. The electronic monitoring circuit may be configured to verify or check that the signal (of the first control unit) toggles only during (or corresponding to) the time window. The electronic monitoring circuit may be configured to verify or check that the signal (of the first control unit) changes state substantially between a rising edge and a falling edge of the trigger window.

[0035] The first control unit, the second control unit, the third control unit and / or the electronic monitoring circuitry may be separate devices and / or may be separated from one another.

[0036] According to various embodiments, the system may be configured to interrupt the treatment in case of an unsafe condition. The unsafe condition may be detected or determined by a watchdog system based on signals of at least one of the electronic monitoring circuitry, the first control unit, the second control unit, and the third control unit. The operating system may be configured to control a GUI device. The first, second, and / or third control units may be configured to control a heating system or a valve actuator or a pump device of the medical system.

[0037] The medical system may further include a housing in which at least two of the first control unit, the second control unit, the third control unit, and the electronic monitoring circuitry are disposed. The first control unit, the second control unit, the third control unit, and the electronic monitoring circuitry may all be disposed within the housing.

[0038] According to various embodiments, if the electronic monitoring circuitry detects a fault (e.g., based on a signal and / or a trigger window), the electronic monitoring circuitry can be configured to send a master fault signal that causes certain elements of the medical system to be placed in a state that is safe for the patient. For example, a pump device may be de-energized (e.g., via a relay), a heating system may be de-energized (e.g., via a relay), and / or a valve in communication with the patient may be set to a closed position (e.g., via a (first, second, or third) control unit).

[0039] This document also provides a healthcare system for providing care to a patient, comprising: A first processor configured to execute an operating system (or boot loader software, or an open source OS, or a commercial OS) (e.g., a third-party OS) and / or medical software; a second processor separate from the first processor; a watchdog module separate from the first and second processors and configured to interrupt an unsafe state or transition to a safe state (e.g., to bring the medical system into a safe state) or to detect a failure (e.g., a failure of the medical system or one of the processors); A medical system is disclosed that includes at least one of the following:

[0040] The second processor may be configured to define, generate, create, initiate, or initiate a trigger window and / or send a trigger window (e.g., a signal associated with the trigger window or time window) to the first processor and the watchdog module. - reading or receiving a trigger window signal; and / or - for example, generating a signal (e.g., a supply signal) in response to (e.g., during) a trigger window; and / or - Send a signal to the watchdog module depending on the trigger window (e.g. during the trigger window) to supply the watchdog module within the trigger window, e.g. It may be configured as follows.

[0041] According to various embodiments, the watchdog module may be configured to output a fault signal based on the signal and a trigger window, e.g., if the signal is not provided to the watchdog module within the trigger window. The watchdog module may be configured to compare the signal to the trigger window and / or determine if the signal was sent on time, e.g., within the trigger window, and / or determine if the first processor provided the watchdog on time, e.g., within the trigger window.

[0042] The health system a first communication line configured to provide a connection between the first processor and the second processor (e.g., a wired connection, such as via at least a portion of a PCB); a second communication line configured to provide a connection (e.g., a wired connection, such as via at least a portion of a PCB) between the first processor and the watchdog module; a third communication line configured to provide a connection (e.g., a wired connection, such as via at least a portion of a PCB) between the second processor and the watchdog module; may include:

[0043] The second processor may be configured to send the trigger window to the first processor and the watchdog module via the first and third communication lines, respectively. The first and third communication lines may be in electronic communication. The first processor may be configured to send a signal to the watchdog module via the second communication line.

[0044] According to various embodiments, the operating system (OS) may not be a real-time operating system and / or may be a third-party OS. The operating system may include software of unknown origin (SOUP), off-the-shelf software (OTS), and / or commercial off-the-shelf software (COTS). The OS may be configured to support or execute medical software. The first processor may be configured to execute protection software for the medical system.

[0045] The first processor may synchronize the signal with the trigger window to send the signal during a period defined by the trigger window, and the synchronization may be performed for each trigger window received by the first processor, or only once.

[0046] According to various embodiments, the watchdog module may include a logic circuit configured to output a fault signal based on a logic operation result of the signal and a trigger window. The watchdog may be configured to verify or check that the signal toggles only during (or corresponding to) the trigger window. The watchdog may be configured to verify or check that the signal changes state substantially between a rising edge and a falling edge of the trigger window.

[0047] According to various embodiments, the medical system may further include a third processor separate from the first processor, the second processor, and a watchdog module configured to interrupt the unsafe condition. The second processor may be configured to send a trigger window to the third processor, and / or the third processor may be configured to read or receive the trigger window. The third processor may monitor or check the trigger window (e.g., its type or its characteristics) according to a predetermined trigger window (e.g., its type or its characteristics).

[0048] The system may be configured to interrupt therapy in the event of an unsafe condition. The operating system may be configured to control a GUI device. The first processor, the second processor, and / or the third processor may be configured to control a heating system or a valve actuator or a pump device of the medical system.

[0049] The medical system may further include a housing in which at least two of the first processor, the second processor, the third processor, and the watchdog module are disposed. The first processor, the second processor, the third processor, and the watchdog module may all be disposed within the housing.

[0050] According to various embodiments, if the watchdog module detects a fault (e.g., based on a signal and a trigger window), the watchdog module can be configured to send a master fault signal that causes certain elements of the medical system to be placed in a safe state for the patient. For example, a pump device may be de-energized (e.g., via a relay or transistor), a heating system may be de-energized (e.g., via a relay or transistor), and / or a valve in communication with the patient may be set to a closed position (e.g., via the (first, second, or third) processor).

[0051] This document also: Sequential logic circuits, a first processor configured to send a signal to a sequential logic circuit; a second processor configured to send a trigger signal to the sequential logic circuit; The sequential logic circuit may be configured to interrupt an unsafe state of at least one of the first and second processors and / or send a fault signal to at least one of the first and second processors.

[0052] According to various embodiments, the electronic monitoring module includes: a first group of flip-flop circuits, each including a first input connected to the second processor and a second input connected to the first processor; a second group of flip-flop circuits, each including a third input connected to the first processor and a fourth input connected to the second processor; Assembly of logic gates; may include at least one of the following:

[0053] The first input may be a D input. The second input may be a CP input. The third input may be a D input. The fourth input may be a CP input.

[0054] The first group of flip-flop circuits may include two (e.g., only two) flip-flop circuits. The Q outputs of both flip-flop circuits may be connected to a logic gate (e.g., of an assembly of logic gates). The second group of flip-flop circuits may include two (e.g., only two) flip-flop circuits. The Q outputs of both flip-flop circuits may be connected to a logic gate (e.g., of an assembly of logic gates).

[0055] The assembly of logic gates may include at least one of an AND gate, an OR gate, a NAND gate, a NOR gate, an XOR gate, and an XNOR gate.

[0056] The advantages of this system are: - The watchdog may be similar to a windowed watchdog, but can be used in a non-real-time OS. - A third party OS (which may be a SOUP) and medical applications may be executed by the same processor. The trigger window or time window may be adjustable by changing a signal parameter (eg frequency) of the second processor. - A watchdog may be an electronic circuit that controls a part of the system's hardware without software; and / or - The watchdog may be used regardless of the type of OS (third-party OS, SOUP, real-time OS, non-real-time OS, etc.). [Brief description of the drawings]

[0057] The present invention will be better understood in light of the following detailed description, including the non-limiting examples illustrated in the following figures. [Figure 1] FIG. 1 illustrates a processor operatively connected to several components. [Diagram 2]FIG. 2 illustrates a number of processors operatively connected to the components. [Diagram 3] FIG. 1 illustrates an embodiment of a medical system. [Figure 4a] FIG. 1 illustrates another embodiment of a medical system. [Figure 4b] FIG. 1 illustrates another embodiment of a medical system. [Diagram 5] FIG. 1 illustrates an embodiment of a medical system. [Figure 6] FIG. 1 illustrates an embodiment of a medical system. [Figure 7] FIG. 1 illustrates an electronic embodiment using a watchdog module. [Figure 8] 1 is a flow chart used by the watchdog module. [Figure 9] FIG. 2 shows an electronic monitoring circuit. [Figure 10] FIG. 2 shows an electronic monitoring circuit. [Figure 11] 3 shows a diagram of a first processor signal (304), a second processor signal (300), and a watchdog signal (308). [Figure 12] 3 shows a diagram of a first processor signal (304), a second processor signal (300), and a watchdog signal (308). [Figure 13] 3 shows a diagram of a first processor signal (304), a second processor signal (300), and a watchdog signal (308). [Figure 14] 3 shows a diagram of a first processor signal (304), a second processor signal (300), and a watchdog signal (308). DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0058] In the following detailed description, reference is made to the accompanying drawings, which form a part hereof, and in which some embodiments of devices, systems, and methods are illustrated by way of example. It is to be understood that other embodiments are contemplated and may be made without departing from the scope or spirit of the present disclosure. Therefore, the following detailed description should not be taken in a limiting sense. All scientific and technical terms used herein have the meanings commonly used in the art unless otherwise specified. The definitions provided herein are intended to facilitate understanding of certain terms frequently used herein, and are not intended to limit the scope of the present disclosure.

[0059] As used in this specification and the appended claims, the singular forms "a," "an," and "the" include embodiments having plural referents unless the content clearly dictates otherwise.

[0060] As used in this specification and the appended claims, any directions referred to herein, such as "top," "bottom," "left," "right," "upper," "lower," and other directions or orientations, are described herein with reference to the figures for clarity and are not intended to limit the actual device or system. The devices and systems described herein can be used in a variety of directions and orientations.

[0061] As used in this specification, the words "have," "having," "include," "including," "comprise," "comprising," and the like are used in an open-ended sense and generally mean "including, but not limited to."

[0062] As used herein, "at least one of A, B, and C," "at least one of A, B, or C," "selected from the group consisting of A, B, C, and combinations thereof," etc. are used in an open-ended sense to include "A only, or B only, or C only, or any combination of A, B, and C," unless the content clearly dictates otherwise.

[0063] As used in this specification and the appended claims, the term "or" is generally used in its sense including "and / or" unless the content clearly dictates otherwise.

[0064] As used herein, the terms "microprocessor" or "processor" are broad terms and are used in their ordinary sense to include, but are not limited to, a computer system or processor designed to perform arithmetic and logical operations using logic circuitry that responds to and processes the basic instructions that run the computer.

[0065] This disclosure relates to all medical systems suitable for delivering treatment to a patient, and although portions of this document focus on one dialysis system, the entire disclosure cannot be limited to that system.

[0066] According to various embodiments, as shown in Figure 1, the medical system (2) may include at least one of a processor (10), a memory device (11), an input device (12), and an output device (13). At least one of the memory device, the input device, and the output device may be operatively coupled to the processor, for example, by an operative link (3). The operative link may include conductive traces (e.g., on a printed circuit), a wired link, and / or a wireless link. The processor may be a microcontroller.

[0067] Memory devices may be read only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory such as ferroelectric polymer memory, ovonic memory, phase change or ferroelectric memory, silicon oxide nitride oxide silicon (SONOS) memory, magnetic or optical cards, arrays of devices such as redundant array of independent disks (RAID) drives, solid-state memory, and the like. The memory device may include various types of computer-readable storage media and / or systems in the form of one or more high-speed memory units, such as a state memory device (e.g., a USB memory, a solid-state drive (SSD), and any other type of storage medium suitable for storing information. Additionally, the memory device may include various types of computer-readable storage media in the form of one or more slower memory units, including an internal (or external) hard disk drive (HDD), a magnetic floppy disk drive (FDD), an optical disk drive for reading from and writing to a removable optical disk (e.g., a CD-ROM or DVD), and a solid-state drive (SSD).

[0068] The input device (12) may include at least one of a keyboard, a button, a touch screen, and an electronic port (e.g., a USB port, etc.). The output device (13) may include at least one of a pump device, an actuator (e.g., an occlusion device or a relay), a display device, a touch screen, a warming device, and an electronic port (e.g., a USB port, etc.).

[0069] According to various embodiments, as shown in FIG. 2, the medical system may include several processors (two or more), and each element (input, output, and / or memory device) may be operatively coupled to a (e.g., dedicated) processor. For example, a first element or group of elements may be operatively coupled to a first processor via operative link (3), a second element or group of elements may be operatively coupled to a second processor via operative link (3), a third element or group of elements may be operatively coupled to a third processor via operative link (3), a fourth element or group of elements may be operatively coupled to a fourth processor via operative link (3), and a fifth element or group of elements may be operatively coupled to a fifth processor via operative link (3). To reduce costs, the number of processors may be limited, although to ensure patient safety, the medical device may include a minimum number of processors. At least two processors may be operatively coupled to each other via an operative link (3) to send, share, receive, read, listen, execute a process, and / or initiate a signal. For example, a third processor may send a signal that may be read, listened to, or received by the first and second processors (for ease of explanation, this document does not distinguish between the terms "read," "listen," and "receive").

[0070] For example, the first processor may be a main processor, which may execute at least one of an operating system, a medical application, and a protective application, the first processor may control at least one of a display, a button, and a touch screen, the second processor may control a heating device, the third processor may control a pump device, the fourth processor may control a first group of occlusion devices, and the fifth processor may control a second group of occlusion devices (which may be different from the first group).

[0071] According to various embodiments, the medical system may include a process that is initiated upon occurrence of a fault. This process may be referred to as a "master fault." A master fault may be initiated to ensure patient safety. For example, a master fault may stop a heating device (e.g., switch off the heating device), may stop a pump device (e.g., switch off the power supply to the pump / motor), and / or close an occlusion device. The master fault may be initiated or triggered by at least one of a processor and a watchdog. The master fault may act on a relay, for example, to power off the pump device and / or the heating device and / or prompt the processor to execute a process.

[0072] According to various embodiments, the medical system (2) may include at least one fluid circuit that may be in fluid communication with the patient's body.

[0073] As shown in FIG. 3, in a simple embodiment, the medical system (2) may include a pump device (55), a supply bag (51), a drain bag (69), and at least one of a fluid pathway configured to enable fluid communication between the patient's body (1) and at least one of the supply bag (51) and the drain bag (69).

[0074] The pump device (55) may include a peristaltic pump and may operate in a forward (first direction) or reverse (second direction) (which is opposite to the forward (first direction)). The fluid path may include at least one occlusion device (61, 66) configured to open and close a portion of the fluid path. The occlusion device may include at least one of a valve and a clamp. The occlusion device may include or be operatively coupled to at least one valve actuator. The medical device may further include at least one processor configured to or operatively coupled to control the one or more occlusion devices and at least one of their (e.g., dedicated) actuators.

[0075] According to various embodiments, the pump device may be configured to move a first amount of fluid from the supply bag (51) to the patient and a second amount of fluid from the patient (1) to the drain bag (69). However, it may be difficult to monitor the first and second amounts moved by the pump device (55). Indeed, medical systems may prioritize flow from the supply bag to the patient over the other flow, or vice versa.

[0076] If the embodiment is a peritoneal dialysis system, during the filling phase, the medical system may be configured to operate the pump in a forward direction to move the dialysate initially stored in the supply bag (51) to the patient's body (1), to open the (supply) occlusion device (61) and to close the (drain) occlusion device (66). During the draining phase, the medical system may be configured to operate the pump in a reverse direction to move the dialysate stored in the patient's body (1) to the drain bag (69), to open the (drain) occlusion device (66) and to close the (supply) occlusion device (61). However, in this embodiment, a significant amount of used dialysate remains in the fluid path after the draining phase. Also, if the dialysis treatment includes a series of repeated cycles that include successive filling and draining phases, the patient's body will receive a significant amount of used dialysate (which may increase the risk of infection or reduce the effectiveness of the treatment). Furthermore, as explained above, the actual amount of fluid replaced may differ from the expected amount of fluid replaced. Therefore, it may be preferable to use the pump only in one direction to fill and drain the peritoneal cavity.

[0077] According to various embodiments shown in FIG. 4a, the medical system may include similar elements to the embodiment of FIG. 3, although the fluid paths may be different. In this embodiment, the pump device is preferably operated in a forward direction (e.g., during the filling and draining phases in the case of peritoneal therapy). Thus, the medical system may be configured to operate the pump in a forward direction to move the solution initially stored in the supply bag (51) to the patient's body (1), to open the first and seventh occlusion devices (61, 67), and to close the sixth and fourth occlusion devices (66, 64). Furthermore, the medical system may be configured to operate the pump in a forward direction to move the solution stored in the patient's body (1) to the drain bag (69), to open the sixth and fourth occlusion devices (66, 64), and to close the first and seventh occlusion devices (61, 67).

[0078] The fluid pathway may include an upstream line (57) and a downstream line (58). The fluid pathway may include a patient line (70). The upstream line (57) is configured to allow fluid to flow from a source (such as a supply bag or a patient) to the pump device (55). The downstream line (58) is configured to allow fluid to flow from the pump device (55) to a destination (such as a drain bag or a patient) (e.g., when the pump is operated in a forward direction).

[0079] The medical system may further include at least one of a pressure sensor 54, an air sensor 56, and other sensors. If a fault is detected by the sensor, the medical system may temporarily operate the pump device in reverse.

[0080] Pressure sensor 54 may measure the pressure of fluid located in or flowing through downstream line 57. Pressure sensor 54 may measure the pressure of fluid located in or flowing through patient line 70. Pressure sensor 54 may measure the pressure of fluid located in or flowing through upstream line 58.

[0081] According to various embodiments shown in Fig. 4b, the medical system further includes two separate processors (71, 72) configured to control and / or monitor the first group of occlusion devices and the second group of occlusion devices, respectively. For example, processor A (71) may be configured to control the first occlusion device (61) and the seventh occlusion device (67), and processor B (72) may be configured to control the fourth occlusion device (64) and the sixth occlusion device (66). This safety architecture allows the line in fluid communication with the patient to be closed even if one of the two processors is disabled or fails.

[0082] According to various embodiments, a first group of occlusion devices (61, 67) may be exclusively controlled by processor A (71) and a second group of occlusion devices (64, 66) may be exclusively controlled by processor B (72).

[0083] Each occlusion device may include a dedicated actuator exclusively connected to a dedicated processor. Thus, each occlusion device may be opened and closed independently (e.g., during treatment). For example, the first occlusion device may be closed by processor A and the seventh occlusion device (67) may be opened by processor A, or vice versa. Also, the fourth occlusion device may be closed by processor B and the sixth occlusion device (66) may be opened by processor B, or vice versa.

[0084] For example, if processor A fails, processor B (72) can close the fourth occlusion device (64) to prevent fluid flow from the supply bag (51) to the patient and close the sixth occlusion device (66) to prevent fluid flow from the drain bag (69) to the patient. If the pump device (55) includes a peristaltic pump having roller(s) for compressing the flexible tubing, the pump device may be further configured to prevent fluid flow from the supply bag (51) to the patient when the pump is in an inoperative state.

[0085] For example, if processor B fails, processor A (71) may close the first occlusion device (61) to prevent fluid flow from the supply bag (51) to the patient and close the seventh occlusion device (67) to prevent fluid flow from the drain bag (69) to the patient. If the pump device (55) includes a peristaltic pump having rollers for compressing a flexible tubing, the pump device may be further configured to prevent fluid flow from the drain bag (69) to the patient when the pump is in an inoperative state.

[0086] According to various embodiments, as shown in Figure 5, the medical system may include similar elements to the embodiment of Figure 4. In this embodiment, the medical system may include additional supply bags (52, 53). Each supply bag (51, 52, 53) or line may include its own / dedicated occlusion device (61, 62, 63).

[0087] The medical system may include a heating device (60) configured to heat the fluid to be infused into the patient to a predetermined temperature. The heating device may be controlled by another processor. An air sensor (56) may be located upstream of the patient to detect air bubbles flowing with the liquid solution (e.g., dialysis fluid).

[0088] According to various embodiments, the medical system may include at least one of a reusable part and a disposable part. The disposable part may include elements that must be discarded after a predefined number of uses, such as after one use. The usable time of the disposable part may directly depend on the number of treatments. These elements may be, for example, elements wetted by a solution, such as dialysis fluid or blood, for example, part of a fluid circuit. The disposable part may include at least one of tubes, connectors, ports, cassettes, valves, etc. The reusable part may include expensive elements, such as, for example, sensors, electronics, screens, actuators of valves or pumps, processors, memories, etc. The reusable part may be used continuously with some disposable parts. The reusable part may include components that may be replaced when the components are excessively worn, broken, or after a predefined period, but much longer than one treatment. The replacement of the reusable part may depend on the wear of the components.

[0089] According to various embodiments shown in FIG. 6, the medical system (100) may include a disposable part (101) and a reusable part (102) (also referred to as a device). The disposable part (101) may include at least one of a bag (104, 105), a tube, and a cassette (106). The reusable part (102) may include at least one of one or more processors (110), one or more screens (111), other elements (112), such as one or more buttons, one or more sensors (113), one or more actuators (114), and other elements (115). The elements (110, 111, 112, 113, 114, 115) may be disposed within a housing of the reusable part. The screen (111) may be a touch screen and may be removably coupled to a housing containing the other elements of the reusable part (102). All or some of the elements (111, 112, 113, 114, 115) may be connected or operatively coupled to one or more processors to control or monitor the treatment. The medical system may further include a watchdog system connected to at least one element (110, 111, 112, 113, 114, 115) of the medical system. The processor (110) may execute computer executable instructions stored in a memory of the system. Some elements (113, 114, 115) of the reusable part may be configured and designed to be operatively (and / or removably) coupled to a disposable part (101), such as, for example, a cassette (106).

[0090] According to various embodiments, the medical system may include one or more cassettes that define at least a portion of the fluid circuit. The cassette is preferably part of the disposable part. The cassette may include at least one of a rigid frame, one or more ports, a fluid cavity, and one or more flexible membranes configured to cover the fluid cavity. The flexible membrane may include a coupling region configured to be operatively coupled with a valve actuator (or occlusion device) and / or a measurement region configured to be operatively coupled with a sensor of the reusable part of the system. The membrane may include a valve portion configured to open and close the fluid circuit. A lug / head of a valve actuator of the reusable part of the system may press the valve portion against the rigid part (e.g., an inner wall of a cavity of the rigid frame) to occlude the fluid circuit. The membrane (particularly the coupling region) may be formed / shaped / structured to have a defined shape, such as a clip element configured to be removably coupled to a head of a valve actuator (not shown).

[0091] According to various embodiments, the cassette may include one or more flexible tubes secured within the cassette by a frame, and the valve actuator may be a pinch valve actuator including a lug configured to pinch the flexible tube through the cassette.

[0092] According to various embodiments, the cassette may include a portion of a pump device. The pump device may include a peristaltic pump. In this case, the cassette may include a flexible tube in fluid communication with the first and second fluid paths of the cassette through dedicated ports. The flexible tube is designed to be pressed against a rigid wall, such as a portion of the rigid frame of the cassette, by at least two rollers of the pump. Each roller may occlude the flexible tube as an occlusion device when the pump is in an inactive state. The cassette may further include a roller assembly including at least two rollers, a roller support device, and a coupling device designed to be operatively coupled to a pump actuator of the reusable portion of the system.

[0093] According to various embodiments, the roller assembly is movably arranged (by rotation) in a cavity of the rigid frame of the cassette. The roller assembly includes at least two rollers held by at least one support. A shaft that is part of a pump device (pump actuator) of the reusable part. The shaft is designed to actuate the roller assembly. In this embodiment, the roller support may include a through hole intended for the shaft of the pump device to be inserted when the cassette is mounted in the reusable part. The roller may be driven by friction and / or may include a coupling device (coupled with the roller support), such as a lug and hole or a gear. When the cassette is fully mounted, the pump part of the cassette is operatively coupled to the pump actuator of the reusable part. The roller may be movable relative to its support, for example, when the shaft of the pump actuator is inserted into the roller support, the outer wall of the shaft presses against the roller, urging it towards the circumferential edge of the support.

[0094] According to various embodiments, the device (the reusable part) may include a housing in which components for controlling the dialysis therapy are located, such as a processor, valve actuators, sensors, and finally parts of a pump device.

[0095] To ensure patient safety, the medical system may include a safety architecture. To this end, the medical system may include a watchdog module configured to monitor the medical system and detect faults. The watchdog module (or electronic monitoring circuitry) may be located inside the medical system (e.g., inside an enclosure). The watchdog module may be configured to monitor the proper operation of a processor running (e.g., third-party) software.

[0096] To reduce software development costs for a medical system, it may be advantageous to add third party software to the medical system. This third party software may include at least one of the following: - Third-party operating systems. - Off-the-Shelf Software (OTS Software): Publicly available software components used by medical device manufacturers where the medical device manufacturers cannot claim complete control of the software lifecycle. - Commercial Off-the-Shelf Software (COTS Software): OTS software provided by a commercial supplier. - Software of unknown development process (SOUP software): Software components that have already been developed and are widely available, but have not been developed to be integrated into a healthcare system (also known as "off-the-shelf software"), or previously developed software for which adequate records of the development process are not available.

[0097] The watchdog module may be configured to be able to interrupt an unsafe state or transition to a safe state (e.g., put the medical system into a safe state) or to detect a failure (e.g., failure of the medical system or one of the processors). To this end, the watchdog module may set some elements of the medical system into a state that is safe for the patient. For example, the watchdog module may: - De-energizing pump devices, heater devices, valve devices, etc. (e.g. via relays), or - Send a signal to the processor to turn off the heat, stop a pump, or close a valve, etc., or - Reboot the system, etc. may be carried out.

[0098] According to various embodiments shown in FIG. 7, the medical system (150) includes: A first processor (151); a second processor (152) separate from the first processor; a watchdog module (155) separate from the first and second processors; may include at least one of the following:

[0099] The first processor (151) may be a main processor. The first processor may execute at least one of (e.g., third-party) software (154) and medical software (155). The software (154) may include a third-party operating system (e.g., Linux), software of unknown origin (SOUP), off-the-shelf software (OTS), and / or commercial off-the-shelf software (COTS). The software may be configured to support, execute, or communicate with the medical software. The first processor may be configured to execute protection software for the medical system. Because the OS may be a third-party OS and / or may not be a real-time operating system, a standard windowed watchdog may not be effective.

[0100] The OS may be configured to control at least one of the user interfaces, e.g., a screen, a touch screen, buttons, USB ports, etc. The medical software may be configured to perform a treatment, e.g., control, monitor, or communicate with components of the device (e.g., sensors, actuators, heating elements, etc.) and / or control, monitor, or communicate with other processors or microcontrollers that may control, monitor, or communicate with component(s) of the device (e.g., sensors, actuators, heating elements, etc.).

[0101] The first processor (151) may be operatively coupled to at least one of the watchdog module (156) and the second processor (152). The medical system may further include a third processor (153) operatively coupled to at least one of the first processor (151), the second processor (152), and the watchdog module (156). For example, the medical system may include: a first communication line configured to provide a connection between the first processor and the second processor; a second communication line configured to provide a connection between the first processor and the watchdog module; a third communication line configured to provide a connection between the second processor and the watchdog module; may include at least one of the following:

[0102] According to various embodiments illustrated in Figure 8, the second processor (152) may be configured to generate a trigger window (or time window) and / or send a trigger window (e.g., a signal associated with the trigger window or time window) to the first processor and the watchdog module (160). - reading or receiving a trigger window signal; and / or - for example, generating a signal (e.g., a supply signal) in response to (e.g., during) a trigger window; and / or - sending a signal to the watchdog module in response to the trigger window (e.g. during the trigger window), e.g. providing the watchdog module within the trigger window; and / or - synchronizing the signal with a time window or with a signal related to the time window; The device may be configured as follows (162, 163).

[0103] The first processor may synchronize the signal with the trigger window to send the signal during a period defined by the trigger window, and the synchronization may be performed for each trigger window received by the first processor, or only once, or a defined number of times.

[0104] According to various embodiments, the second processor may be configured to send the trigger window to the first processor and the watchdog module over the first and third communication lines, respectively. The first processor may be configured to send a signal to the watchdog module over the second communication line.

[0105] The watchdog module may be configured to check the signals of the first processor (151) and the second processor (152). The watchdog module may be configured to output a fault signal (165) based on the signal and a trigger window, e.g., if the signal is not provided to the watchdog module within the trigger window. The watchdog module may be configured to compare the signal to the trigger window and / or determine if the signal was sent on time, e.g., within the trigger window, and / or determine if the first processor provided the watchdog on time, e.g., within the trigger window. At least one of the first processor (151), the second processor (152), the third processor (153), and the watchdog module (156) may be configured to initiate a "master fault" as disclosed above.

[0106] If the watchdog module detects a fault (e.g., based on a signal and a trigger window), the watchdog module can be configured to send a master fault signal that causes certain elements of the medical system to be placed in a state that is safe for the patient. For example, a pump device may be de-energized (e.g., via a relay), a heating system may be de-energized (e.g., via a relay), and / or a valve in communication with the patient may be set to a closed position (e.g., via the (first, second, or third) processor).

[0107] The watchdog module may include a logic circuit configured to output a fault signal based on a logic operation result of the signal and a trigger window. The watchdog may be configured to verify or check that the signal toggles only during (or corresponding to) the trigger window. The watchdog may be configured to verify or check that the signal changes state substantially between a rising edge and a falling edge of the trigger window.

[0108] As disclosed above, the medical system may further include a third processor separate from the first and second processors and a watchdog module configured to be able to interrupt the unsafe condition. The second processor may be configured to send the trigger window to the third processor, and / or the third processor may be configured to read or receive the trigger window. The third processor may monitor or check the trigger window (e.g., its type or its characteristics) according to a predetermined trigger window (e.g., its type or its characteristics).

[0109] The first, second, and / or third processors may be configured to control a heating system, or a valve actuator, or a pump device of the medical system. For example, the third processor may include two separate processors, each configured to control a group of occlusion devices. The second processor may be configured to control the heating system. The first processor may be configured to control the pump device and / or monitor a sensor.

[0110] The medical system may further include a housing in which at least two of the first processor, the second processor, the third processor, and the watchdog module are disposed. The first processor, the second processor, the third processor, and the watchdog module may all be disposed within the housing.

[0111] According to various embodiments, the watchdog may include an electronic circuit, which may include a logic circuit configured to output a fault signal based on a logic operation result of the received signals.

[0112] According to various embodiments shown in Figure 9, the medical system (200) may include a first processor (also referred to as a first (e.g., main) control unit) (201) and a second processor (also referred to as a second control unit) (202), the first and second processors being operatively coupled (e.g., connected) to a logic circuit (203) configured to output a signal (204) based on received signals of the first and second processors. For example, the sequential logic circuit may be configured to interrupt a fault condition of at least one of the first and second processors and / or send a fault signal to at least one of the first and second processors.

[0113] According to various embodiments shown in Figure 10, the medical system (200) may include a logic circuit (203) that may include an assembly of flip-flop circuits and an assembly of logic gates. For example, the logic circuit may include a first group of flip-flop circuits, the first group of flip-flop circuits including: a first flip-flop circuit (210) having a first input (e.g., a D input) (211) connected to the second processor (202) and a second input (e.g., a CP input) (212) connected to the first processor (201); a second flip-flop circuit (220) having a first input (e.g., a D input) (221) connected to the second processor (202) and a second input (e.g., a CP input) (222) connected to the first processor (201); may include:

[0114] According to various embodiments, a logic gate (260) is disposed between the first processor (201) and the second input (222) of the second flip-flop circuit (220). The logic gate (260) may be configured to invert a signal sent by the first processor (201). For example, the logic gate (260) may be a NAND gate.

[0115] The outputs (213, 223) of the first flip-flop (210) and the second flip-flop (220) may be connected to inputs of a logic gate (261), respectively. For example, the logic gate (261) may be a NAND gate.

[0116] The first group of flip-flops and logic gates (261) may be configured to verify that the signal sent by the first processor (201) toggles only during a time window (or trigger window) sent by the second processor (202). For example, the first flip-flop circuit verifies a rising edge (of the first processor's signal) and the second flip-flop (212) verifies a falling edge (of the first processor's signal) (e.g., via an inverter (260)) when the signal associated with the time window is substantially equal to 1.

[0117] According to various embodiments, the logic circuit may further include a second group of flip-flop circuits, the second group of flip-flop circuits being a third flip-flop circuit (230) having a first input (e.g., a D input) (231) connected to the first processor (201) and a second input (e.g., a CP input) (232) connected to the second processor (202); a fourth flip-flop circuit (240) having a first input (e.g., a D input) (241) connected to the first processor (201) and a second input (e.g., a CP input) (242) connected to the second processor (202); may include:

[0118] According to various embodiments, a logic gate (262) is disposed between the second processor (202) and the second input (242) of the second flip-flop circuit (240). The logic gate (262) may be configured to invert a signal sent by the second processor (202). For example, the logic gate (262) may be a NAND gate.

[0119] The outputs of the third flip-flop (230) and the fourth flip-flop (240) may each be connected to an input of a logic gate (263), which may be, for example, an XNOR gate.

[0120] The second group of flip-flops and logic gates (263) may be configured to verify that the signal sent by the first processor (201) changes state substantially during a time window (or trigger window) sent by the second processor (202), e.g., between a rising edge and a falling edge of the time window. The third flip-flop may be configured to verify that a rising edge of the first processor's signal occurs during the time window. The fourth flip-flop may be configured to verify that a falling edge of the first processor's signal occurs during the time window.

[0121] According to various embodiments, the logic circuit may further include a fifth flip-flop circuit (250) having a first input (e.g., D input) (251) configured to receive a signal from the first or second group of flip-flops and a second input (e.g., CP input) (252) connected to the second processor (202). For example, the first input (251) is connected to an output of the logic gate (263). The fifth flip-flop circuit (250) may be designed to eliminate transient effects between a rising edge of a signal associated with a time window and a toggling of a signal of the first processor.

[0122] According to various embodiments, at least one of the first, second, third, fourth, and fifth flip-flops may include an SR flip-flop, a D flip-flop, a T flip-flop, or a JK flip-flop. For example, at least one of the first, second, third, fourth, and fifth flip-flops may be a D flip-flop.

[0123] According to various embodiments, the logic operation circuit may further include a logic gate (264) having a first input configured to receive a signal from the first group of flip-flops and a second input configured to receive a signal from the second group of flip-flops or the fifth flip-flop. For example, the first input may be connected to the output of the logic gate (261) and the second input may be connected to the output of the fifth flip-flop circuit (250). The logic gate (264) may be an OR gate. The logic gate makes it possible to provide an output signal (204), which may be the "master fault signal" disclosed above.

[0124] The assembly of logic gates may include at least one of an AND gate, an OR gate, a NAND gate, a NOR gate, an XOR gate, and an XNOR gate.

[0125] For example, Figures 11, 12, 13 and 14 show chronograms of the watchdog operation, including the first processor signal (304), the second processor signal (300) and the watchdog signal (308). As long as the first processor signal (304) toggles within the trigger window (301), the master fault is disabled. When the first processor signal (304) stops at the top level (Figures 12 and 13) or stops toggling, the master fault signal (308) is enabled. In some electronic monitoring circuits, the master fault signal (308) may be activated after two pulses of the second processor signal (Figure 13). In this case, the activation time of the master fault (309) needs to be taken into account. This therefore directly affects the frequency of the trigger window. The manufacturer or the second processor may determine the frequency of the trigger window according to the activation time of the master fault. The frequency of the trigger window is determined by considering the activation time of the master fault. If the first processor's signal (304) toggles outside the trigger window (FIG. 14), the master fault signal (308) is (immediately / simultaneously / instantly) asserted. [Explanation of symbols]

[0126] 1...patient, 2...medical system, 3...operative link, 10...first processor, 11...memory device, 12...input device, 13...output device, 14...first element or group of elements, 15...second element or group of elements, 16...third element or group of elements, 17...fourth element or group of elements, 18...fifth element or group of elements, 20...second processor, 30...third processor, 40...fourth processor, 50...fifth processor, 51...first supply bag, 52...second supply bag, 53...third supply bag, 54...pressure sensor, 55...pump device, 56...air sensor, 57...upstream line, 58...downstream line, 59...temperature sensor, 60...heating device, 61...first occlusion device, 62...second occlusion device, 63...third occlusion device, 64...fourth occlusion device, 65...fifth occlusion device, 66...sixth occlusion device, 67...seventh occlusion device, 68...eighth occlusion device, 69...drain bag, 70...patient line, 71...processor A, 72...processor B, 100...medical system, 101...disposable part, 102...reusable part / Device, 104...bag (drain bag), 105...bag (fresh solution), 106...cassette, 110...processor, 111...screen (device such as tablet with touch screen), 112...other elements such as buttons, 113...sensor, 114...actuator, 115...other elements connected to the processor and operatively and removably coupled to the disposable part, 116...watchdog system, 150...medical system, 151...first processor, 152...second processor, 153...third processor, 154...software, 155... medical software, 156... watchdog module, 160... generating or sending a signal related to a time window, 161... checking a time window, 162... synchronization, 163... sending a signal, 164... checking a signal, 165... fault signal, 200... watchdog system or medical system, 201... first processor or first (e.g. main) control unit, 201'... signal sent by or from the first processor or first control unit, 202... second processor or second control unit, 202'...signals sent by or from a second processor or second control unit, 203...logic operation circuit, 204...output signal, 210...first flip-flop circuit or element, 211...first input or D input, 212...second input or CP input, 213...output, 220...second flip-flop circuit or element, 221...first input or D input, 222...second input or CP input, 223...output, 230...third flip-flop circuit or element, 231...first input or D input, 232...second input or CP input, 233...output, 240...fourth flip-flop circuit or element, 241...first input or D input, 242...second input or CP Input, 243...output, 250...fifth flip-flop circuit or element, 251...first input or D input, 252...second input or CP input, 253...output, 260...logic gate, 261...logic gate, 262...logic gate, 263...logic gate, 264...logic gate, 265...first input, 266...second input, 300...second processor signal, 301...trigger window or time window, 302...open window / rising edge, 303...close window / falling edge, 304...first processor signal, 305...toggle up, 306...toggle down, 307...watchdog signal, 308...master fault signal.

Claims

1. A medical system (2) for transferring fluids to and / or from a patient (1), comprising: a fluid path including a patient line (70), a fill line having a dialysate bag (51, 52, 53, 105), and a drain line having a drain bag (69, 104); a first group of occlusion devices (61, 67) and a second group of occlusion devices (64, 66), each group including at least two occlusion devices configured to occlude the fluid pathway; a first processor (71) operatively coupled to the first group of occlusion devices; a second processor (72) operatively coupled to the second group of occlusion devices; a pump (55) configured to move the fluid through the fluid path; Equipped with the first group of occlusion devices and the second group of occlusion devices are arranged to be able to occlude the fluid paths between the dialysate bag (51, 52, 53, 105) and the patient and to occlude the fluid paths between the drain bag (69, 104) and the patient, such that if one of the two processors (71, 72) is made to fail or fails, the other processor (71, 72) can control the occlusion devices to occlude the fluid paths between the patient and the drain bag (69, 104) and between the patient and the dialysate bag (51, 52, 53, 105), Medical System (2).

2. The system of claim 1 , wherein the pump (55) is configured to move the fluid from the fill line to the patient line (70) and from the patient line (70) to the drain line.

3. The system of claim 1 or 2, wherein a first occlusion device of the first group of the at least two occlusion devices is disposed on the filling line.

4. The system according to any one of claims 1 to 3, wherein a first occlusion device of the at least two occlusion devices of the second group is disposed on the exhaust line.

5. The system according to any one of claims 1 to 4, wherein the pump (55) is a peristaltic pump.

6. 6. The system of claim 1, wherein the pump (55) includes a rotary motor, and the fluid paths and the pump (55) are arranged to allow unidirectional rotation of the pump's rotary motor to move the fluid from the fill line to the patient line, and from the patient line to the drain line.

7. The system of any one of claims 1 to 6, wherein the pump (55) includes an inlet port connected to the fill line and the patient line.

8. The system of any one of claims 1 to 7, wherein the pump (55) includes an outlet port connected to the exhaust line and to the patient line.

9. 9. The system of claims 7 and 8, wherein the patient line (70) includes fluid connections to the inlet port and the outlet port, the inlet port and the outlet port being separate from one another.

10. 10. The system of claim 9, wherein the patient line (70) connected to the inlet port includes a second occlusion device of the second group of the at least two occlusion devices.

11. The system of claim 9 , wherein the patient line connected to the outlet port includes a second occlusion device of the first group of the at least two occlusion devices.

12. 10. The system of claim 9, wherein the fill line is connected only to an inlet port.

13. The system of claim 9 , wherein the exhaust line is connected only to the outlet port.

14. The system of any one of claims 1 to 13, wherein at least one of the occlusion devices includes an actuator connected to a dedicated processor.

15. The system of claim 14 , wherein a first group of the actuators are powered by a power source that is different from a power source of a second group of the actuators.

16. A medical system (150) for providing treatment to a patient, comprising: a first processor (151, 201) configured to execute an operating system (OS) (154) and medical software (155); a second processor (152, 202) separate from the first processor (151, 201); a watchdog module (156) separate from the first processor and the second processor, the watchdog module (156) being configured to be able to detect a fault in the medical system (150); Including, the second processor (152, 202) is configured to generate a trigger window and send the trigger window to the first processor and to the watchdog module; The first processor (151, 201) is configured to generate and send a signal to the watchdog module (156) in response to the trigger window; the watchdog module (156) is configured to output a fault signal based on the signal and the trigger window. Medical system (150).

17. 20. The system of claim 16, wherein the OS is not a real-time operating system.

18. 18. The system of claim 16 or 17, wherein the operating system includes software of unknown origin.

19. The system of any one of claims 16 to 18, wherein the OS is configured to support the medical software.

20. The system of any one of claims 16 to 19, wherein the first processor (151, 201) is configured to execute protection software for the medical system.

21. The system according to any one of claims 16 to 20, wherein the watchdog module (156) includes a logic operation circuit (203) configured to output the fault signal based on a logical operation result of the signal and the trigger window.

22. The system of any one of claims 16 to 21, wherein the first processor (151, 201) is configured to synchronize the signal with a trigger window in order to send the signal during a period defined by the trigger window.

23. The system of any one of claims 16 to 22, wherein the watchdog module verifies that the signal only toggles during the trigger window.

24. 24. The system of any one of claims 16 to 23, wherein the watchdog module is configured to verify that the signal changes state substantially between a rising edge and a falling edge of a trigger window.

25. The system of any one of claims 16 to 24, further comprising a third processor (153) separate from the first processor and the second processor and separate from the watchdog module (156) configured to be able to abort an unsafe state or transition to a safe state.

26. The system of claim 25, wherein the second processor (152, 202) is configured to send the trigger window to the third processor (153).

27. 27. The system of claim 26, wherein the third processor (153) checks the trigger window according to a predetermined trigger window.

28. The system of any one of claims 16 to 27, wherein the system is configured to interrupt the treatment in the event of an unsafe condition.

29. The system of any one of claims 16 to 28, wherein the operating system is configured to control a GUI device.

30. The system of any one of claims 16 to 29, wherein the second processor (152, 202) is configured to control a heating system or a valve actuator or a pump device.

Images