System and method for the central control of devices used during an operation

[0001] This application is a continuation of copending international patent application PCT/EP01/10189 filed Sep. 5, 2001 and designating U.S., which claims priority of European Application EP 00 119 179.0 filed Sep. 5, 2000.

[0002] The present invention relates to a system and a method for the central control of devices, particularly medical devices, which are used during an operation, comprising a first control unit for control of the devices.

[0003] For ergonomic reasons it is desirable to be able to remote control and control, respectively, the control device of all systems required during an operation from a central position, if possible out of a sterile area. Such a control may be carried out for example via a touch-screen (with a sterile cover) or via a voice control. The controlled devices and systems, respectively, may comprise for example endoscopic devices, as well as an op-table, op-lighting, room lighting, air conditioning, telephone, pager, internet, hospital-information system, consumption parts, management system and so on.

[0004] In view of the control of medical devices document DE 199 04 090 A1 for example discloses to interconnect single devices via a CAN-bus, the single devices being used as slaves and a host computer as master. All devices are controllable via this host computer.

[0005] The disadvantage of such a network is for example that the software- and hardware-efforts to be taken for the single host computer are very high since it has to be adapted to the device to be controlled having to fulfill the highest safety requirements. In view of devices to be controlled without having to fulfill these high safety requirements it may be possible that flexibility and simplicity of the handling may be lost.

[0006] If the single host computer is designed by applying a less stringent standard with respect to safety aspects, the risk would arise (for example for a PC with standard software like Windows-NT), however, said safety-related functions would be endangered by unreliable functions of non safety-related systems.

[0007] In this case it is assumed that the mentioned medical devices may be divided into two different groups, namely safety-related systems on the one hand, as for example endoscopic devices (insufflators, pumps, or RF-surgery and so on), op-table-control etc., namely devices or systems which may be life-threatening for a patient in the event of a breakdown or failure, and non-safety-related systems on the other hand, like picture archiving, material management systems, telephone remote control etc.

[0008] In view of the above the object of the present invention is to provide for a system and a method, respectively, which do not have the before mentioned disadvantages. Particularly it is to increase the safety in respect to the control of safety-related devices.

[0009] This object is solved by the system of the afore-mentioned kind by providing a second control unit which is connected with the first control unit for exchange of information, and the first control unit is embodied as a closed system for control of at least those devices which carry out safety-related functions (safety-related devices) and the second control unit is embodied as an open system for control of the remaining devices which carry out non safety-related functions (not safety-related devices).

[0010] This means in other words that the inventive system does not use a single host computer at has been done up to now, but uses two control units instead which are each assigned to different groups of devices to be controlled. When assigning the devices to be controlled to those control units it is assumed that there are generally devices for carrying out safety-related functions (for example endoscopic devices) and on the other hand devices for carrying out non-safety-related functions, like room lightening, air conditioning etc., during an operation. In this connection the term closed system describes a system which does not allow any intervention from outside the system.

[0011] Such a system cannot be manipulated, reconfigured etc. neither by a user directly nor via the internet etc. In contrast thereto an open system may be configured or for example supplemented by a user. Here, interventions and manipulations, respectively, from outside are possible.

[0012] The advantage of the inventive system is among others that the provision of a further control unit increases the safety with respect to undesired erroneous or faulty functions without limiting the flexibility of the whole system thereby. Due to the fact that on the second control unit software may be used which have not to fulfill such stringent safety requirements as it is the case for the control of safety-related devices, standard software may be used so that the single investment costs on the one hand as well as the running maintenance costs of the total system on the other hand may be reduced.

[0013] A further advantage of the inventive system is that the first control unit which is responsible for the control of the safety-related devices is embodied as a closed system which secures that all attempts to manipulate the operating system are disabled. Moreover also manipulations of the applications for controlling the safety-related devices are impossible.

[0014] At this point it is to be noted, however, that on the first control unit also applications for control of non safety-related devices could run provided that these applications have been tested under safety aspects before.

[0015] Advantageously, those control units are each part of independent computers (PC's). Of course, it is also contemplated that those control units are integrated in one computer which comprises at least two processors (CPU) with one control unit being realized by one processor.

[0016] When using a single host computer and considering such requirements it would not be possible to carry out the control of non safety-related devices with the desired simplicity and flexibility. Moreover the risk would always arise that erroneously programmed software for the non safety-related devices would influence the control of safety-related devices.

[0017] In a preferred embodiment the first control unit and the safety-related devices are interconnected via a bus-system preferably the Karl Storz-communication-bus (SCB). Preferably, the non safety-related devices and the second control unit are interconnected via a further bus-system, both bus-systems preferably being different.

[0018] These measures result in a simplification of the system as well as to a reduction of the total costs since the especially designed bus-system for safety-related functions is not used for the control of every devices. Rather also conventional standard bus-systems may be used. Hence the expensive safety bus-system is only used for the interconnection of the safety-related devices.

[0019] In a preferred embodiment an interface unit is provided which is connected with both control units on the one hand and with peripheral devices on the other hand and which connects each of the control units with the peripheral devices. Preferably, the interface unit is controlled by the first control unit via a control line. More preferably the peripheral devices comprises a monitor device and/or an input device, preferably a keyboard and a mouse. More preferably, the monitor device is provided as a touch-screen also allowing an input.

[0020] These above mentioned measures result in the advantage that the costs for the total system are reduced on the one hand and the handling is significantly simplified on the other hand since the peripheral devices required for input of control instructions or for monitoring of parameters are provided only once. The surgeon has not to observe plural monitor devices hence. Further, the control line between the interface unit and the first control unit guarantees that the control unit controlling the important safety-related devices also allows the respective necessary function and displays the important safety-related parameters on the touch-screen in case of a breakdown and an failure, respectively, of the second control unit. Altogether, also an increase of the safety level of the system is achieved.

[0021] In a preferred embodiment the second control unit comprises a receiving means to capture error messages from the first control unit and to display them on one of the peripheral devices.

[0022] This measure has the advantage that also in case of a connection of the second control unit with the interface unit for the control of non safety-related devices error messages concerning safety-related devices are immediately provided to the user of the system. It may hence be avoided that the display of such error messages is only signaled to the user upon re-switching the connection from the first control unit to the peripheral devices. Consequently, this has the advantage that the safety of the total system is further increased.

[0023] Preferably the safety-related devices include endoscopic devices, preferably insufflators, pumps, light sources, video devices and for example op-table-controllers etc. The non safety-related devices include for example picture archiving, op-lighting, room lighting, telephone, air conditioning, pager, internet, hospital system, consumption parts, management systems, etc.

[0024] It is further preferred to interconnect both control units via an Ethernet-bus (TCP/IP-protocol), since this type of bus-system has been proved as reliable and cost effective.

[0025] In a preferred embodiment the first control unit comprises an embedded operating system, preferably embedded windows NT, which is protected against interventions from outside the system.

[0026] This means in other words that the operating system of the first control unit is a fixed component of the unit and is hence protected against manipulations. The user may not carry out any interventions into the operating system. This would be possible for example with current PC's. Hence, it is avoided that specific safety-related functions can not be carried out anymore or are carried out erroneously due to intentional or unintentional interventions into the operating system.

[0027] In a preferred embodiment the first control unit comprises a check means which cyclically checks the connection with the interface unit and outputs an error message if a connection is not present.

[0028] Also this measure results in an increase of safety because the system signalizes the user immediately when a display and a setup, respectively, of respective parameters of safety-related devices are not possible anymore due to the failure of the interface unit.

[0029] In a preferred embodiment the first control unit comprises a voice control, for example in form of a software module.

[0030] This measure has the advantage that the operation by the surgeon is simplified.

[0031] The object underlying the present invention is also solved by a method for the central control of devices used during an operation in that the devices for the control of safety-related functions are controlled by a first control unit and the devices for carrying out non safety-related functions are controlled by a second control unit.

[0032] This method allows to realize the advantages mentioned in connection with the afore-mentioned inventive system in the same manner so that the advantages may not be described here anymore.

[0033] In a preferred embodiment both control units communicate with each other, while preferably the first control unit checks the second control unit for faults. It is further preferred to provide for an interface unit which is controlled by the first control unit and which in response thereto forwards signals either from the first or the second control unit to a common peripheral device.

[0034] This measure hasas already mentionedthe advantage that the costs of the system are reduced and the ease of operation is increased.

[0035] In a preferred embodiment the first control unit will drive the interface unit in case of a failure of the second control unit such that the signals of the first control unit are forwarded to the peripheral devices.

[0036] This means in other words that the first control unit ensures that a failure in the second control unit does not result in the breakdown of the connection between the first control unit and the peripheral devices.

[0037] In a preferred embodiment the interface unit forwards the signals of the first control unit to the peripheral devices immediately if a safety-related function is to be carried out.

[0038] This measure has the advantage that the important functions are possible also when the present connection between the second control unit and the peripheral devices is present. The result is an increase of safety.

[0039] In a preferred embodiment the interface unit forwards the signals of the second control unit to the peripheral devices after activating a non safety-related function only when the safety-related function is completed and completely carried out, respectively. This means in other words that the execution of safety-related functions cannot be interrupted by switching the interface unit. Rather, the execution of the safety-related function is carried out up to the end and only than the interface unit will build up the connection between the second control unit and the peripheral devices.

[0040] Further advantages and embodiments of the invention can be taken from the following description and the enclosed drawings.

[0041] It is to be understood that the features mentioned above and those yet to be explained below can be used not only in the respective combinations indicated, but also in other combinations or in isolation, without leaving the scope of the present invention.

[0042] The invention will now be described in detail with reference to a FIGURE, the FIGURE showing a schematic block diagram of an inventive system.

[0043] In the FIGURE a system for the central control of devices used during an operation is shown as a block diagram and is indicated with reference numeral 10. The system 10 comprises a first computer unit 12 and a second computer unit 14. Both computer units 12, 14 are interconnected via a bus-connection 16, for example an Ethernet-bus-connection, in order to exchange data in form of messages.

[0044] Both computer units 12, 14 are provided as medical PC's, wherein the first computer unit 12 uses an embedded operating system, preferably an embedded windows NT-operating system. The second computer unit 14 operates preferably with a common windows operating system or an other non embedded operating system.

[0045] The first computer unit 12 serves at least for the control of medical devices, witch carry out safety-related and safety critical functions, respectively. In the FIGURE, these safety-related devices are indicated with reference numeral 20. For example, in the FIGURE, a pump 25, an insufflator 24 and RF generator 26 are shown. These exemplary enumeration of three devices is not to be understood in any limiting sense what is indicated in the FIGURE by further devices n and m. Furthermore, the first computer unit 12 may also be used for the control of non safety-related devices provided that respective tested software is used. However, this possibility will not be further discussed below.

[0046] The communication between the first computer unit 12 and the safety-related devices 20 is achieved via a bus-system 28 which allows a safe transmission of data. In view of this bus-system 28 other requirements with respect to fail safety has to be considered as is the case in the afore-mentioned Ethernet-bus 16. The applicant offers such a bus-system for example under the name Karl Storz-Communication-Bus (SCB).

[0047] The system 10 further comprises a switching unit 30. The switching unit 30 is connected with its input side to the computer unit 12 and the computer unit 14, wherein in the FIGURE only one connection line 33, 35 each is exemplarily shown. It is to be understood that these connection lines 33, 35 comprise a plurality of single connection lines.

[0048] On the output side the switching unit 30 is connected with peripheral devices 40, wherein in the FIGURE a touch sensitive monitor 42 (called touch-screen), an input keyboard 44 as well as a mouse 46 are shown as an example. The peripheral devices 40 are located for example in the direct sphere of the surgeon in the operation room so that these peripheral devices 40 have to be adapted accordingly. The touch-screen 42 is for example provided with a sterile cover.

[0049] The connection of the peripheral devices 40 with the switching unit 30 is made via respective lines 48, wherein for simplification reasons only one line is shown each representing a plurality of connecting lines.

[0050] A switching unit 30 has the task to connect each peripheral device 42 to 46 with one of both computer units 12, 14 so that the input and the display, respectively, of data is possible.

[0051] The control of the switching unit 30 is provided by the first computer unit 12, and respective control signals may be transmitted to the switching unit 30 via a control line 38.

[0052] The second computer unit 14 is connected (indirect-coupled) with the devices 52 via an optical bus 50, which devices carry out non safety-related functions. Such functions are for example telephone remote control, room lighting, etc. The control of these non safety-related devices is hence achieved by the second computer unit 14.

[0053] As already mentioned, the first computer unit 12 is equipped with an embedded operating system. This should guarantee that interventions into the systems or manipulations of the systems from outside are not possible. The first computer unit 12 is rather a embodied as a closed system on which only tasks are running which are required for the control of the safety-related devices 20. Also, tasks may run additionally which serve to control the non safety-related devices 42 in case that these tasks are tested in view of safety aspects before.

[0054] The second computer unit 14 is however provided as a common medical PC. In contrast to the first computer unit 12 no tasks are allowed to run on the second computer unit 14, which tasks serve to control safety-related devices.

[0055] Both computer units 12, 14 supply data by the respective lines 33, 35 to the switching unit 30 and depending on the position of the switching unit only the data of one of both computer units are displayed on the touch-screen 42. Also the input of data is carried out only in this computer unit. In case that the surgeon wants to select for example functions of the other group of devices, he may do this via a respective input of an instruction which is either directly received by the first computer unit 12 or indirectly received via the computer unit 14 and the bus 16 by the first computer unit 12. In response thereto it transmits a respective control signal via the control line 38 causing a switching in the switching unit 30. On the touch-screen 42 the respective data, selecting menus etc. of the selected group of devices will than be displayed.

[0056] In case of a connection between the second computer unit 14 with the peripheral devices 40 it is necessary that any error messages relating to safety-related devices 20 are immediately signalized to the surgeon independent of the switch condition of the switching unit 30 via the touch-screen 42. For this, a task is running in the second computer unit 14 which continuously checks the messages sent by the first computer unit 12 via the bus 16 for failure messages. If an error message is detected the second computer unit 14 ensures that a window is opened on the touch-screen in which the error message is displayed.

[0057] A further task of the first computer unit 12 is to check the presence of the switching unit 30. If the switching unit 30 cannot be detected anymore by the first computer unit 12 for example due to breakdown, the first computer unit 12 must immediately generate an error message. This error message is to signalize the surgeon that an appropriate display and an input of data via the peripheral devices 40 may not be guaranteed anymore.

[0058] Further it is necessary that the first computer unit 12 checks the second computer unit 14 and in case of a failure the switching unit 30 is immediately set in those switching conditions in which the first computer unit 12 is connected with the peripheral devices 40.

[0059] Under safety aspects it is also necessary that when inputting an instruction for switching the peripheral devices 40 to the second computer unit 14 all not yet completed functions of the safety-related devices 20 are first completed with a respective display of the parameters. This is to guarantee that the execution of these safety-related functions is not terminated to early. In the reverse case, however the peripheral devices 40 are immediately connected with the first computer unit 12 so that a safety-related function may be carried out without any delay.

[0060] It is to be understood that the invention may be realized not only in form of the afore-mentioned embodiment but also in other embodiments. The scope of such modifications is only defined by the appended claims.