Method and apparatus for error warning with multiple alarm levels and types

[0001] The present invention relates to the notification of a detection of a leak (including needle-disconnects and other causes of loss of integrity) in extracorporeal blood circuits and more particularly to the use of escalating alarm levels and multiple types of alarms to notify users.

[0002] Many medical procedures involve the extraction and replacement of flowing blood from, and back into, a donor or patient. The reasons for doing this vary, but generally, they involve subjecting the blood to some process that cannot be carried out inside the body. When the blood is outside the patient it is conducted through machinery that processes the blood. The various processes include, but are not limited to, hemodialysis, hemofiltration, hemodiafiltration, blood and blood component collection, plasmaphresis, aphresis, and blood oxygenation.

[0003] One technique for extracorporeal blood processing employs a single access, for example a single needle in the vein of the patient or a fistula. A volume of blood is cyclically drawn through the access at one time, processed, and then returned through the same access at another time. Single access systems are uncommon because they limit the rate of processing to half the capacity permitted by the access. As a result, two-access systems, in which blood is drawn from a first access, called an arterial access, and returned through a second access, called a venous access, are much faster and more common. These accesses include catheters, catheters with subcutaneous ports, fistulas, and grafts.

[0004] The processes listed above, and others, often involve the movement of large amounts of blood at a very high rate. For example, 500 ml. of blood may be drawn out and replaced every minute, which is about 5% of the patient's entire supply. If a leak occurs in such a system, the patient could be drained of enough blood in a few minutes to cause loss of consciousness with death following soon thereafter. As a result, such extracorporeal blood circuits are normally used in very safe environments, such as hospitals and treatment centers, and attended by highly trained technicians and doctors nearby. Even with close supervision, a number of deaths occur in the United States every year due to undue blood loss from leaks.

[0005] Leaks present a very real risk. Leaks can occur for various reasons, among them: extraction of a needle, disconnection of a luer, poor manufacture of components, cuts in tubing, and leaks in a catheter. However, in terms of current technology, the most reliable solution to this risk, that of direct and constant trained supervision in a safe environment, has an enormous negative impact on the lifestyles of patients who require frequent treatment and on labor requirements of the institutions performing such therapies. Thus, there is a perennial need in the art for ultra-safe systems that can be used in a non-clinical setting and/or without the need for highly trained and expensive staff. Currently, there is great interest in ways of providing systems for patients to use at home. One of the risks for such systems is the danger of leaks. As a result, a number of companies have dedicated resources to the solution of the problem of leak detection.

[0006] In single-access systems, loss of blood through the patient access and blood circuit can be indirectly detected by detecting the infiltration of air during the draw cycle. Air is typically detected using an ultrasonic air detector on the tubing line, which detects air bubbles in the blood. The detection of air bubbles triggers the system to halt the pump and clamp the line to prevent air bubbles from being injected into the patient. Examples of such systems are described in U.S. Pat. Nos. 3,985,134, 4,614,590, and 5,120,303.

[0007] While detection of air infiltration is a reliable technique for detecting leaks in single access systems, the more attractive two-access systems, in which blood is drawn continuously from one access and returned continuously through another, present problems. While a disconnection or leak in the draw line can be sensed by detecting air infiltration, just as with the single needle system, a leak in the return line cannot be so detected. This problem has been addressed in a number of different ways, some of which are generally accepted in the industry.

[0008] The first level of protection against return line blood loss is the use of locking luers on all connections, as described in International Standard ISO 594-2 which help to minimize the possibility of spontaneous disconnection during treatment. Care in the connection and taping of lines to the patient's bodies is also a known strategy for minimizing this risk.

[0009] A higher level of protection is the provision of venous pressure monitoring, which detects a precipitous decrease in the venous line pressure. This technique is outlined in International Standard IEC 60601-2-16. This approach, although providing some additional protection, is not very robust, because most of the pressure loss in the venous line is in the needle used to access the patient. There is very little pressure change in the venous return line that can be detected in the event of a disconnection, so long as the needle remains attached to the return line. Thus, the pressure signal is very weak. The signal is no stronger for small leaks in the return line, where the pressure changes are too small to be detected with any reliability. One way to compensate for the low pressure signal is to make the system more sensitive, as described in U.S. Pat. No. 6,221,040, but this strategy can cause many false positives. It is inevitable that the sensitivity of the system will have to be traded against the burden of monitoring false alarms. Inevitably this leads to compromises in safety. In addition, pressure sensing methods cannot be used at all for detecting small leaks.

[0010] Yet another approach, described for example in PCT application U.S.98/19266, is to place fluid detectors near the patient's access and/or on the floor under the patient. The system responds only after blood has leaked and collected in the vicinity of a fluid detector. A misplaced detector can defeat such a system and the path of a leak cannot be reliably predicted. For instance, a rivulet of blood may adhere to the patient's body and transfer blood to points remote from the detector. Even efforts to avoid this situation can be defeated by movement of the patient, deliberate or inadvertent (e.g., the unconscious movement of a sleeping patient).

[0011] Still another device for detecting leaks is described in U.S. Pat. No. 6,044,691. According to the description, the circuit is checked for leaks prior to the treatment operation. For example, a heated fluid may be run through the circuit and its leakage detected by means of a thermistor. The weakness of this approach is immediately apparent: there is no assurance that the system's integrity will persist, throughout the treatment cycle, as confirmed by the pre-treatment test. Thus, this method also fails to address the entire risk.

[0012] Yet another device for checking for leaks in return lines is described in U.S. Pat. No. 6,090,048. In the disclosed system, a pressure signal is sensed at the access and used to infer its integrity. The pressure wave may be the patient's pulse or it may be artificially generated by the pump. This approach cannot detect small leaks and is not very sensitive unless powerful pressure waves are used; in which case the effect can produce considerable discomfort in the patient.

[0013] Detection of leaks by prior art methods fails to reduce the risk of dangerous blood loss to an acceptable level. In general, the risk of leakage-related deaths increases with the decrease in medical staff per patient driven by the high cost of trained staff. Currently, with lower staffing levels comes the increased risk of unattended leaks. Thus, there has been, and continues to be, a need in the prior art for a foolproof approach to detection of a return line leak or disconnection.

[0014] Quick response to blood leaks is the best means to reduce patient blood loss. Alarms may go unnoticed or be confused with other problems that are less serious than a leak in an extracoporeal blood system.

[0015] According to the present invention, the probability of a leak, its seriousness, the amount of time the leak condition has persisted without a response, and other factors may be used to control escalation of multiple types of alarms. In a simple embodiment, for example, there may be a staged audio signal that has a certain loudness and tonal quality when a leak is first detected and becomes more conspicuous as time goes by without a reset response from a user. According to an embodiment, different types of leak detection signals are employed. These may be combined to generate a probability of a leak. They may also be combined to generate a leak severity or a combined probability/severity. Also, a signal indicating the amount of time a leak alarm goes without being responded to may also be generated. All of these signals may be combined in some fashion to generate an alarm and escalate it through multiple stages, each chosen according to the corresponding type of response required and the degree of urgency. The particulars of the correlation are left to the designer, but examples of the types of responses include:

[0016] Soft audio signals, Loud audio signals, Harsh-sounding (irritating) audio signals;

[0017] Flashing lights, Colored lights;

[0018] E-mail messages, Network messages, Pager messages;

[0019] Telephone and cell phone messages including audio prerecorded phone call announcements;

[0020] Commands to output alerts sent to other devices such as receivers, radios, televisions, or monitors;

[0021] Broadcast signals to other devices such as monitors, radios, television sets, etc.

[0022] The multiple-input/multiple-level alarm system of the invention may require many sensors to communicate with a controller and for the controller to communicate with multiple output devices and user interfaces. But, as it happens that, often, the components of a multiple input, multiple-level alarm system may only need to communicate with each when conditions reach an abnormal status. This application, therefore, provides a inoffensive context for using acoustic signals to communicate between components; a sort of chirp network to interconnect the functional components of the system. Note that the same functionality may be achieved by generating audio signals outside the range of human hearing or using spread-spectrum techniques to reduce the sound pressure to subaudible levels at any given frequency and reduce the subjective impact of sound.

[0023] The invention will be described in connection with certain preferred embodiments, with reference to the following illustrative figures so that it may be more fully understood. With reference to the figures, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of the preferred embodiments of the present invention only, and are presented in the cause of providing what is believed to be the most useful and readily understood description of the principles and conceptual aspects of the invention. In this regard, no attempt is made to show structural details of the invention in more detail than is necessary for a fundamental understanding of the invention, the description taken with the drawings making apparent to those skilled in the art how the several forms of the invention may be embodied in practice.

[0024] FIG. 1A is an overview block diagram of functional components of a multiple-sensor multiple-level alarm system according to an embodiment of the invention.

[0025] FIG. 1B is a block diagram of an alarm condition detection and control system for a blood treatment device according to an embodiment of the invention and consistent with the embodiment of FIG. 1A.

[0026] FIG. 1C is a figurative diagram of a hardware context in which the invention may be implemented.

[0027] FIG. 2 is figurative illustration of a continuity/bioimpedance sensor built into a hypodermic needle for use with the embodiment of FIGS. 1A-1C as well as other embodiments of the invention.

[0028] FIG. 3 a figurative illustration of a video image processing front end for use with the embodiment of FIGS. 1A-1C as well as other embodiments of the invention.

[0029] FIG. 4 is a figurative illustration of a blood oxygen sensor for use with the embodiment of FIGS. 1A-1C as well as other embodiments of the invention.

[0030] FIG. 5 is an illustration of an intermittent fluid circuit testing apparatus using line clamps and a pressure gauge.

[0031] FIG. 6 is a flow chart indicating an alarm status upgrade algorithm according to an embodiment of the invention.

[0032] FIG. 7 illustrates functional components of a subsystem for generating multiple alarm-level outputs according to an embodiment of the invention.

[0033] FIG. 8 is a flow chart indicating an alarm status control algorithm which may incorporate the status upgrade algorithm of FIG. 6.

[0034] FIG. 9 is an illustration of an analog version of a signal combiner for controlling an alarm output for leak detection.

[0035] FIG. 10 is an example configuration of a blood processing system with leak detection which combines multiple inputs.

[0036] FIG. 11 illustrates components of an alarm network using acoustical signals to communicate among components.

[0037] Referring to FIG. 1A according to an embodiment of the invention, signals from multiple sensor inputs A, B, . . . N indicated at 10, 15, . . . 20 are applied to an alarm condition detector 30. The alarm condition detector 30 determines whether an alarm condition exists. By combining multiple inputs, effects, even ones that are insufficiently determinative on their own to be reliable alarm indicators can, in combination, provide a highly reliable indicator of an alarm condition. That is, if multiple sensor signals are combined to produce a net valence, the impact of a false positive or negative in any one of them is reduced.

[0038] An alarm condition classifier 35 may then identify the nature of the alarm condition detected by the alarm condition detector. The functions of detecting an alarm condition 30 and classifying the alarm condition 35 (i.e. identifying the type of alarm condition) would be performed by the same process or step. For example, in a classification engine such as a Bayesian classifier or neural network, many inputs are combined to recognize the current system status. Determining the status, for example: patient has lost a significant amount of blood, could be a classification derived from multiple simultaneous inputs, for example: elevated heart rate, fluid detected outside blood circuit, air detected inside blood circuit, and patient weight dropping slightly. Each of these different inputs contribute to varying degrees and ways depending on the values of other inputs according to how the classifier is programmed. In sophisticated systems that make use of artificial-intelligence, the interaction of the inputs can be complex. But, from the overarching perspective, many inputs are combined to generate a current status signal and that status signal is either a normal status or an aberrant status, the latter being one for which an alarm may be generated. Thus, the process of classifying the status includes detecting an alarm condition.

[0039] Put another way, the current state vector is the ordered set of all current values of the sensors 10-20. Classification reduces the large variety of state vectors to some set of state classes some of which correspond to normal and some of which correspond to alarm state classes. The recognition of abnormal state vectors subsumes the step of identifying the class to which the state vector belongs. A current alarm condition, output by alarm condition classifier 35, is used by an alarm controller 40 to activate one or more selected alarm outputs 45, 50, . . . 55.

[0040] Referring now to FIG. 1B, to illustrate a hardware environment where the multiple inputs/multiple level alarm system may be used, consider a patient 300 being treated by an extracorporeal blood treatment machine 310. A pressure monitor 340 is connected to monitor a patient access 341 connected to a blood circuit 320 of the blood treatment machine 310. A monitoring system node 350 has an alarm output 365, which may include, for example, a flashing light or a speaker or siren. Not shown here, the alarm output may additionally or alternatively have a component for sending messages via public or private telephone (i.e., private branch exchange, PBX, or publicly switch telephone networks, PSTN), cell networks, computer networks, the Internet, or radio transmissions e.g., as indicated by the antenna 360, to other locations. A video camera 325 continuously captures images of the patient 300 and transmits these to the monitoring system node 350, which may include an image-, or video-, processing component to reduce data in the image or video sequence to some form manageable to be classified in the monitoring system node 350.

[0041] Various other sensors may include a pulse monitor, for example a fingertip pulse monitor 330, a blood circuit pressure monitor 335, etc. A user-interface terminal 370 permits alarms to be responded to and for changes to be made in programming, initialization, and training of classification algorithms.

[0042] Image and video processing are complex fields where much development activity is occurring. It is possible for image processing software to recognize faces, specific objects, certain colors, and various different components of a scene in a field of view. For example, known image processing techniques can be used to zero-in on the face of the patient 300 and to recognize changes in facial expression or body position. These may be classified according to various schemes and used as inputs to the alarm condition detector 30/classifier 35 of FIG. 1A. For an example, a body position output might be the average angle formed by the body at the major joints or the amount of movement of the hands. The facial expression output may be according to a number of published works produced by academic research directed at making user interfaces more responsive to user's current emotional state.

[0043] A microphone 345 or other transducer such as a directional sound transducer may capture sounds generated by the patient 300 or other occupants. Front-end processing that may be applied to sound input includes speech recognition and classification of normal and irregular sound patterns.

[0044] Referring to FIG. 1C, to illustrate some of the kinds of inputs that can be combined to drive an alarm system according to the invention, a controller/classifier 190 receives signals from a plurality of different sensors 110-152 and outputs control signals to various output devices and final controllers 160-180. In an implementation of the invention, any all or different input and output devices may be employed, the illustrated embodiment being an example for purposes of discussion only. The controller/classifier 190 combines the data from the various inputs to determine a current alarm level and takes various actions based on the current alarm level. The input signal may be combined in a linear or non-linear fashion using analog or digital mechanisms for signal processing to generate its output signals. The controller/classifier 190 may be an analog or digital device, but is preferably based on a programmable processor. Also, preferably, it includes a user interface (not shown separately in FIG. 1A) for modifying its settings and allowing a user to respond to alarms.

[0045] Pressure sensors 110 may be any of a variety of different absolute, gauge, or differential pressure-monitoring sensors that have been proposed for use in leak detection. For example, venous line pressure monitoring as described in International Standard IEC 60601-2-16 and U.S. Pat. No. 6,221,040. The pressure sensors 110 may also be one or more differential pressure monitors, that may be used to test a portion of a circuit by clamping both ends of the portion and observing the gauge pressure for a brief interval for a change that would indicate leakage. See, for example, the discussion attending FIG. 5, below.

[0046] A patient weight scale 125 may be used to generate a current weight for the patient. Such a scale 125 may be built into a chair, couch, or bed. The patient weight scale 125 input device may produce a time-integrated signal using a low pass filter (not illustrated) to remove transients due to patient movement. The patient weight by itself may be too subtle a signal, or provide inadequate lead-time to used alone for patient safety, but it may participate in earlier warning if combined with other data and may provide help in late stage warning or alarm escalation as discussed in more detail below, particularly with reference to FIG. 6.

[0047] Blood oxygen sensors 140 provide an indication of blood oxygen level, which may indicate blood loss due to a leak. Blood oxygen sensors 140 may be optical-based sensors and may be located along the blood circuit.

[0048] Acoustic sensors 142 may be used to advantage in leak detection in a number of ways. In the commonly-assigned application incorporated by reference below, audio sensors 142 are proposed as a means for detecting the infiltration of air. For example, a hydrophone in contact with blood in the blood circuit may detect sounds from air bubbles being generated. Another way in which acoustic sensors 142 may be used is to detect sounds from the patient or ambient surroundings. For example, snoring might indicate that the patient has fallen asleep or disturbed breathing might indicate distress. Other input modalities such as video or image data 152 may also be machine-interpreted to yield such indicators. Patient status, in combination with other information, for example heart rate, may change a normal state into an alarm state. That is, a given heart rate may be indicative of nothing if a patient is watching television but may be indicative of physical distress if the patient is sleeping. In an intelligent system, sounds can contribute in many ways to develop a context by which other signals are either interpreted differently or augmented in some ways. The examples are myriad: activity in the patient's vicinity may indicate that others are in attendance, thereby justifying a higher threshold for an alarm status to be generated; the sounds of children may be recognized by an audio recognition engine and used to alert an attendant that children might be at risk or pose a risk to the patient; speech from the patient may be machine-interpreted and used to trigger alarms or other events. Various artificial intelligence techniques may be employed to leverage such inputs.

[0049] Fluid sensors 115 may be used to detect blood or other fluids that have leaked from the blood processing system or connections. For example, a collector placed within the housing of the blood processing machine may detect leaks by funneling any leaking blood into a fluid sensor, which may thereafter indicate the presence of fluid by an output signal. The patient heart rate 130 may be output to the controller/classifier 190 as well. As mentioned above, the heart rate 130 may indicate distress, for example, due to hypovolemia due to blood loss. Continuity detectors 120 and bioimpedance sensors 150 may also be used to provide indications of a needle falling out or loss of blood from tissues.

[0050] Air sensors 135 are frequently used in blood processing equipment to prevent air emboli and for detecting leaks in the draw portions of a blood circuit. Also, in the commonly assigned pending application Method and Apparatus for Leak Detection in a Fluid Line, the entirety of which is hereby incorporated by reference as if fully set forth herein in its entirety, air sensors 135 are proposed to be used to detect leaks in other portions of a circuit by intermittently creating negative pressure in otherwise positive-pressure portions of the blood circuit. The latter technique is a highly reliable method of leak detection. Given the gravity of a leak in an extracorporeal blood processing system, however, it is always useful to increase reliability, if possible.

[0051] The controller/classifier 190 may also control components of the blood processing system, such as a pump 175, line clamps 160, and flow controllers 180 such as four-way valves. Control of these components may permit the controller/classifier 190 to shut down the system to prevent further loss of blood. In addition, the controller/classifier 190 may be connected to various alarm output devices 165-170, for example an automatic telephone message generator, a flashing light, an audible alarm, etc.

[0052] Referring now to FIG. 2, a hypodermic needle 217, such as might be used to access a fistula or blood vessel of a patient, has pads 212 and 214 for making electrical contact with the patient or blood of the patient. A continuity/bioimpedance sensor 150/120 provides power and signal processing to generate an output receivable by the controller/classifier 190. One of the contact pads may be elongated and resistive as indicated at 212 so that if the hypodermic needle 217 is drawn out only partly, a graduated signal may be generated. The device of FIG. 2 may, for example, be used to indicate that a needle has fallen out or is beginning to fall out.

[0053] Referring to FIGS. 1A-1C and 3, video/image data 152 may be gathered by a camera 220 and pre-processed by a video-image processor 215. The latter may be programmed to recognize physiognomic features of the patient's face, body position, surrounding circumstances, etc. and to generate a classification symbol in response to it. The latter may also be programmed to recognize, by fairly simple image processing, blood pooling on the floor or staining the patient's clothes. The output video image data 152 of video/image processor 215 may be an output vector indicating various states it is programmed to recognize. The video/image processor 215 may be also be a simple device capable only of detecting blobs in the field of view that might indicate blood leaks in the camera's 220 field of view.

[0054] Referring to FIG. 4, a blood oxygen sensor 225/227 (140 in FIG. 1C, shown with a separate sensor part 227 and driver/signal conditioner part 225) may be a simple optical device attached to tubing 229 inside a blood processing system, for example. Blood oxygen may prove a useful metric.

[0055] Referring now to FIG. 5, line clamps 245 and 250 may be periodically closed either simultaneously or sequentially so that a positive or negative pressure is built up in a test circuit portion 255. A pressure sensor 240, which may be one of pressure sensors 110 contemplated in the embodiment of FIGS. 1A-1C, generates a continuous pressure signal which may be received by the controller/classifier 190. If the pressure signal relaxation time constant is inconsistent with a desired integrity of the tested circuit portion, this data may be usable for generating an alarm status, either alone or in combination with other data.

[0056] Referring now to FIG. 6, an algorithm that may be used to generate variable alarm states begins with the sensing of an alarm condition in step S10. The alarm condition may be any of the sensors shown in FIGS. 1A-1C or others alone or in combination to predict that a leak exists or may exist. In response to the alarm condition, a watchdog timer is initialized and started to count down the time elapsed since the alarm condition event of step S10. Step S30 passes to step S35 as long as the watchdog timer continues to run. Step S35 loops back to step S30 unless a new alarm condition occurs. When the watchdog timer lapses, step S40 determines if the alarm condition has been responded to. Based on a blood flow rate of 500 ml./min., for example, the time interval should be no longer than one minute. Based on a slower potential flow, the interval may preferably be longer. The interval may be adjusted depending on the flow rate of the blood processing machine 310, which may be adjustable. If no response is indicated in step S40, an alarm level is incremented in step S50 and control returns to step S20. If a new alarm condition occurs in step S35 before the watchdog timer lapses, control jumps to step S50. If the alarm is responded to in step S40, control returns to step S10 where the system waits for an alarm condition.

[0057] According to the example procedure of FIG. 6, an alarm is escalated if nobody responds to it, by entering an acknowledgement or command into the user interface (for example, see terminal 370 and associated discussion of FIG. 1B), within a certain time frame. Preferably, the time frame depends on the type of alarm condition or the degree of certainty. Referring now to FIG. 7, according to the invention, each alarm level is associated with a different kind of alarm. A first alarm level could be an audible signal such as a beep or a buzzer; a soft alarm 415. There may be multiple levels of soft alarms which may be triggered by command signals from the controller/classifier 190. A second alarm level might be a louder alarm or a buzzer at a remote station such as a nurse's station; a hard alarm 420. The terms soft and hard here are intended to convey the relative severity or seriousness of the alarm condition. The level of significance of each alarm and the types of alarms to be used may be determined on a case by case basis.

[0058] Alarms may include messages sent by any suitable messaging system. For example, still referring to FIG. 7, an alarm could be an automated telephone message to a remote location such as a family member or a security station, a doctor's pager or cell phone, or simply a louder alarm signal. All of these may be performed in response to a classification result transmitted as data (here identified as class symbol) by the controller classifier 190 to a PBX/PSTN dialer and message generator 410. For example, the controller/classifier 190 may send a message by telephone to a caretaker, a doctor, a nurse, or a police-emergency destination. The controller/classifier 190 may also transmit a command symbol along with a class symbol to indicate which of multiple possible channels the message is to be conveyed upon. In addition, the command symbol may include an indication of a type of message based on the current alarm level. Other alarms may employ messages sent via a network or via the Internet, as indicated by a Network/Internet message generator 425 in the figure. These may be programmed to appear as text messages or to sound alarms in other locations.

[0059] Note that although the discussion so far has been concerned principally with leak detection, with the multiple inputs available, the system may give notice of various irregular conditions such as patient status, non-leak problems with the blood processing equipment, and others. Therefore, various different types of alarm conditions may be identified besides leaks. Also, each of the different alarm conditions, including leaks, can be further broken down into different types of alarm conditions. Thus, although in the embodiments discussed above, different alarms were distinguished by level, implying a linear scale, the invention is certainly not limited to such a single ladder-type structure. Certain types of alarms may be better suited to certain conditions than others. For example, one type of alarm condition may require the attention of highly skilled person such as a doctor or nurse while another type of alarm condition could be handled by a less-skilled person such as a nurse's aid or orderly. Thus, a message to a doctor's pager might be provided in response to some alarm conditions and not in response to other alarm conditions. To provide for this, as well as the progressive levels of alarm contemplated in the foregoing, separate alarm level ladders may be defined. Each ladder may correspond to a different superclass of conditions recognized by the controller/classifier 190. The controller/classifier 190 would then implement alarms according to a current ladder. If multiple alarm conditions arise, these may be handled by following the ladders for both conditions. Thus, messages corresponding to both existing alarm conditions would be generated, for example. For example, a leak detection might cause an audible alarm to be generated at a first level which would progress to a louder alarm which would progress to an alarm at a nurse's station. That would be one ladder. Another ladder might be, for example, a progression from a local alarm (on the processing machine) to a remote alarm (at a nurse's station) to a pager alarm (to a doctor or physician's assistant).

[0060] Referring to FIG. 8, a simplified control algorithm for illustrating the above ideas begins with step S105 where the controller/classifier 190 waits for an alarm condition and then determines its alarm class in step S110. In step S115, an alarm level ladder is associated with the alarm condition class identified in step S110. In step S120, a command is generated to invoke the alarm corresponding to the first rung of the ladder selected in step S115. Alternatively, a given ladder may be entered on a higher selected level responsively to a severity of the alarm condition identified in step S110.

[0061] Note that although alarm levels were discussed as being incremented responsively to the length of time the condition existed without response thereto, other scaling effects may be used to escalate the alarm level. As discussed above, the alarm condition classification may provide one such scaling factor. Some classes of alarm conditions may be classified as more severe than others. In addition, the severity of a given condition may provide a higher-level entry point or cause the alarm level to escalate. For example, patient distress could be mild, indicating the appropriateness of a first low level alarm, or it could be severe indicating a more urgent alarm should be generated. Again, also, the type of alarm may correspond to the type or severity of alarm condition according to the standards of the system designer.

[0062] In step S125, the system may wait for either the severity, type, or delay-till-response warrants an escalation in alarm level or change in the type of alarm. With a response, which resets the alarm condition, control returns to step S105.

[0063] Note that programmable controllers may be the most versatile and often the cheapest mechanism for implementing aspects of the invention, such as the combination of multiple inputs, but they are not the only way. A simple analog system can provide an ability to form a weighted sum of the outputs of two detectors. For example, referring to FIG. 9, Detector A 505 and detector B 510 each applies its respective signal to a respective one of signal multipliers 520 and 525, respectively. The signal multipliers 520 and 525 may amplify the respective signals, including inverting, attenuating, and augmenting its magnitude. A summer 530 adds the amplified values of the two signals to produce a final output that drives an alarm 515. The result is that one detector's output may function as an inhibitor of another, or it may have the effect of changing the alarm-triggering threshold of the signal from another detector. FIG. 9 is exemplary and not comprehensive. It is possible to use the output of one detector to determine the weight applied to another signal and linear and non-linear combinations of two or more signals may be combined in various ways to extend the combination shown in FIG. 9, as would be clear to a person of skill in the field of complex analog control systems.

[0064] Referring now to FIG. 10, in the area of leak detection, which is one of the most important safeguards involved in extracorporeal blood treatment, an example shows how the belt and suspenders approach of combining multiple inputs can be used to clear advantage. As described in U.S. patent application Ser. No. 09/894,236, the entirety of which is hereby incorporated by reference as if fully set forth herein, blood processing machine 483 has leak detection components built into it. The machine includes air sensors 460 and 470, a filter 480, and a reversible pump 475, the latter being one mechanism for reversing flow to test the return circuit as discussed in the patent application incorporated by reference above. As discussed in this reference, the two air sensors 460 and 470 may quickly detect any leaks in draw and return accesses 462 and 463 of the patient 410 when the pump is driven in forward and reverse directions, respectively. An additional leak detection feature includes a funnel 490 at the bottom of an enclosure housing a housed portion 484 of a blood circuit 464 with a fluid detector 485 at the bottom of the funnel 490. Any leaks occurring in the housed portion 484 will be directed by the funnel 490 toward the fluid detector 485. The fluid detector 485 may be any suitable device for detecting blood, for example, a continuity tester. The fluid detector 485 may be linked to the same alarm system as the air sensors 460 and 470 and be responded to in the same manner as discussed in connection with any of the embodiments described herein.

[0065] The system may be programmed such that the air sensors 460 and 470 protect the access lines 462 and 463 outside the machine by providing for flow reversal only as far as necessary to detect leaks in normally-positively pressurized lines. In that case, the fluid detector 485 may provide warning for any leaks inside the blood processing machine 483 and the air sensors protection for the access lines. Alternatively, the system may be programmed such that the protection fields overlap, that is, the pump 475 reverses for a sufficient displacement of blood that any leaks at all may be detected while air detection provides another level of protection. In this case, if the sensitivity of the air detector 460 and 470-based leak detection is raised, but modulated according to the status of the fluid detector 485 signal such that an air sensor signal of a low level indicating a leak does not result in an alarm condition unless it is accompanied by a leak indication by the fluid detector 465, false positives arising from the air sensors can be reduced and the sensitivity of the system enhanced. The sensitivity of the fluid detector may be similarly increased, resulting in the possibility of detecting smaller leaks than a system calibrated to operate without such cooperation among leak detection subsystems. Note that the overlap in protection zones can be increased by providing one or more additional fluid detectors under the lines or an extension to the funnel 490 to catch fluid leaking from the access lines 462 and 463.

[0066] Referring now to FIG. 11, a multiple-input/multiple-level alarm system employs many sensors 405, 410, . . . 415 to communicate with a controller 420 and for the controller 420 to communicate with multiple output devices and user interfaces 424 and data processors and relays 422. In the present embodiment, rather than wire the components together, they communicate with each other using respective sound signal generators 425, 426, 427, 428, 429, and 423 and receivers 431, 432, 433, and 434.

[0067] The signals are preferably articulated sufficiently to encode unique identifiers so that multiple systems within hearing range of one another do not cause interference. Also, the sound pattern may encode information other than an identifier of the transmitter and/or receiver, for example, it can encode a type of status or magnitude of a detected condition, such as heart rate or degree of wetting of a fluid detector. The sounds may be above or below the frequency range of human hearing to avoid the subjective impact. Alternatively, the signals may be spread over ranges of frequency by modulating with a pseudorandom code. The subject effect of such spread-spectrum signals can be very low due to the noise-like nature of the sound and the low power levels required for data transmission.

[0068] In a system where the components of a multiple input, multiple-level alarm system may only need to communicate with each when conditions reach an abnormal status, the audibility of a given signal may pose a problem. The particular alarm system application, therefore, may provide an inoffensive context for using acoustic signals to communicate between components; a sort of chirp network to interconnect the functional components of the system. In fact, the audibility of communication signals may provide a benefit. For example, an attendant called to a location by a remote-station alarm may be greeted not only by a user interface indicating the nature of the problem but also by the sending unit's characteristic audio signal. This may reinforce the output from the user interface increasing comprehension by the attendant of the alarm condition that occurred.

[0069] Some sensors, such as indicated for sensor C 415, may have the ability to receive as well as send signals. The data processor/relay 422 may be, for example, a component of the acoustic network that processes information outside the controller 420. For example, it could reduce data from other sources unburdening the controller 420 or permitting feature-upgrades to the controller without requiring its replacement or modification.

[0070] It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.