Robust alarm system

[0001] The present application claims priority benefit under 35 U.S.C. §119(e) from U.S. Provisional Application No. 60/726,638, filed Oct. 14, 2005, entitled “Robust Alarm System,” which is incorporated herein by reference.

[0002] Physiological measurement systems employed in healthcare often feature visual and audible alarm mechanisms that alert a caregiver when a patient's vital signs are outside of predetermined limits. For example, FIG. 1 illustrates a pulse oximeter, which measures the oxygen saturation level of arterial blood, an indicator of oxygen supply. A typical pulse oximetry system 100 has a sensor 101 that provides a sensor signal 162 to a pulse oximeter (monitor) 102. The sensor 101 has emitters 110 and a detector 120 and is attached to a patient at a selected fleshy tissue site, such as a fingertip. The emitters 110 transmit light having red and IR wavelengths into the tissue site. The detector 120 generates the sensor signal 162 in response to the intensity of the emitter transmitted light after attenuation by pulsatile blood flow within the tissue site A pulse oximetry sensor is described in U.S. Pat. No. 6,088,607 entitled Low Noise Optical Probe, which is assigned to Masimo Corporation, Irvine, Calif. and incorporated by reference herein.

[0003] The monitor 102 has drivers 140, a controller 150 and a front-end 160. The drivers 140 activate the emitters 110 according to the controller 150, and the front-end 160 conditions and digitizes the resulting sensor signal 162. The monitor 102 also has a signal processor 170, a display 180 and an alarm 190. The signal processor 170 inputs the conditioned and digitized sensor signal 164 and calculates oxygen saturation along with pulse rate, as is well-known in the art. The display 180 provides a numerical readout of a patient's oxygen saturation and pulse rate. The alarm 190 provides an audible indication when oxygen saturation or pulse rate are outside of preset limits. A pulse oximetry monitor is described in U.S. Pat. No. 5,482,036 entitled Signal Processing Apparatus and Method, which is assigned to Masimo Corporation, Irvine, Calif. and incorporated by reference herein.

[0004] Alarm reliability is a critical requirement for physiological measurement systems employed in healthcare. An alarm failure may result in patient injury or death. A robust alarm system provides at least one of redundant alarms, drive circuit integrity checks and alarm integrity checks so as to increase alarm reliability.

[0005] One aspect of a robust alarm system comprises an alarm controller adapted to input an alarm trigger and generate at least one alarm drive signal in response. Alarm subsystems are adapted to input the alarm drive signal and activate alarms in response. A subsystem function signal is output from the alarm subsystems to the alarm controller so as to indicate the integrity of the alarm subsystems. A malfunction indicator is output from the alarm controller in response to a failure within the alarm subsystems.

[0006] In one embodiment, the alarm subsystems have one or more of a driver, a circuit tester and an alarm detector. The driver and a corresponding drive circuit actuates one or more alarms in response to the alarm drive signal. A circuit tester verifies the integrity of the driver and drive circuit. An alarm detector verifies the integrity of at least one of the alarms. Alarm detection may be based upon detecting emitted sound waves or by detecting alarm transducer movement or vibration utilizing ultrasound, optical or piezoelectric sensors to name a few.

[0007] Another aspect of a robust alarm system comprises a processor responsive to a sensor so as to initiate an alarm trigger based upon a physiological event. A controller is responsive to the alarm trigger so as to generate at least one alarm drive signal. Multiple alarms are in communication with the alarm drive signal so as to concurrently indicate the physiological event.

[0008] A further aspect of a robust alarm system is a method where optical radiation having at least two wavelengths is transmitted into a tissue site. A sensor signal is provided in responsive to attenuation of the optical radiation by pulsatile blood flowing within the tissue site. A physiological parameter measurement is derived from the sensor signal, and an alarm trigger is generated in response to the measurement being outside of predetermined limits for the parameter. Multiple alarms are concurrently activated in response to the alarm trigger.

[0009] FIG. 1 is a block diagram of a conventional pulse oximeter;

[0010] FIG. 2 is a block diagram of a physiological measurement system having a robust alarm system;

[0011] FIG. 3 is a block diagram of a robust alarm system;

[0012] FIG. 4 is a schematic diagram of a drive circuit tester;

[0013] FIG. 5 is a block diagram of an acoustic sensor of alarm integrity;

[0014] FIG. 6 is a block diagram of a piezoelectric sensor of alarm integrity;

[0015] FIG. 7 is a block diagram of a ultrasound sensor of alarm integrity;

[0016] FIG. 8 is a block diagram of an optical sensor of alarm integrity;

[0017] FIG. 9 is a block diagram of an tandem speaker coil sensor of alarm integrity; and

[0018] FIG. 10 is a block diagram of a pulse oximeter comprising a portable instrument, and corresponding docking station incorporating a robust alarm system.

[0019] FIG. 2 illustrates a physiological measurement system 200 having a robust alarm system 300. The physiological measurement system 200 has a signal processor 210 responsive to an input sensor signal 212 and a display 220 for presenting the results. For example, the signal processor 210 may be part of a pulse oximetry monitor that is responsive to an intensity signal from an optical sensor, as described above. Likewise, the display 220 may provide a numerical indication of oxygen saturation and pulse rate calculated accordingly. Unlike a conventional alarm 190 (FIG. 1), however, the robust alarm system 300 advantageously has redundant alarms and alarm system integrity checks, as described below.

[0020] As shown in FIG. 2, the signal processor 210 inputs the sensor signal 212 and generates an alarm trigger 214 in response, such as when a parameter calculated by the signal processor is outside of predetermined limits. The alarm system 300 inputs the alarm trigger signal 214 and activates one or more alarms accordingly, as described below. In one embodiment, the alarm system 300 also outputs a malfunction signal 216, which indicates that one or more alarm subsystems 301-303 are unresponsive, i.e. are not generating an alarm in response to the alarm trigger 214. In one embodiment, the malfunction signal 216 is output to the signal processor 210, which may trigger a malfunction indication on the display 220 or trigger a separate malfunction indicator 230, or both. In another embodiment, the malfunction signal 216 is output directly to the malfunction indicator 230. The malfunction indicator 230 may be an audible alert, visual alert or alert signal. An audible alert, for example, may be an alarm, buzzer, recorded or synthesized voice to name a few. A visual alert may be a flashing light or display message, for example. An alert signal may be, for instance, an electronic signal, code or message sent to another system via wired or wireless communication channels, or local area or wide area networks, to name a few.

[0021] Also shown in FIG. 2, the robust alarm system 300 has an alarm controller 310 and one or more alarm subsystems 301-303. The alarm controller 310 inputs the alarm trigger 310 and activates an alarm subsystem 301-303 or multiple alarm subsystems concurrently. The alarm controller 310 also receives a subsystem function signal 305 that provides feedback to the alarm controller 310 as to the integrity of the alarm subsystems 301-303. In one embodiment, the subsystem function signal 305 comprises circuit function signals 332 (FIG. 3) or alarm function signals 352 (FIG. 3) or both, as described with respect to FIG. 3, below. The alarm controller 310 generates the malfunction signal 216 if alarm subsystem integrity has been compromised. In one embodiment, the malfunction signal 216 is encoded or otherwise configured so as to indicate a particular fault type or fault location or both. The fault location may be subsystem, component or subcomponent specific. In a particular embodiment, the alarm controller 310 may activate or deactivate one or more alarm subsystems 301-303 in response to the subsystem function signal 305 so as to work around one or more faulty alarm subsystems 301-303. In various embodiments, the alarm controller 310 may comprise separate hardware, software or firmware components or may be integrated with the signal processor 210. A robust alarm system 300 may be incorporated into a pulse oximeter, such as is described in detail with respect to FIG. 10, below.

[0022] Further shown in FIG. 2, the robust alarm system 300 can be configured for various self-testing, fault correction and alarm condition response. In one embodiment, two or more alarm subsystems 301-303 can be concurrently activated so that multiple alarms sound simultaneously and so that failure of any one alarm or alarm subsystem 301-303 will not result in silence during an alarm condition. These multiple alarms may each sound at different frequencies or frequency spectra so as to facilitate alarm failure recognition and troubleshooting. In another embodiment, the alarm controller 310 deactivates a failing alarm subsystem 301-303 and activates one or more redundant alarm subsystems 301-303 in response to the subsystem function signal 305. In yet another embodiment, the alarm controller 310 initiates alarm subsystem testing in the absence of an alarm condition by intermittently activating the alarm subsystems 301-303. In particular embodiments, intermittent test alarms are activated only long enough for subsystem function 305 feedback or at frequencies outside of a normal hearing range so as to be essentially unnoticeable by caregivers, patients or other personnel operating the physiological measurement system 200.

[0023] FIG. 3 illustrates a robust alarm system 300 having an alarm controller 310, drivers 320, circuit testers 330, alarms 340 and detectors 350. The alarm controller 310 responds to the alarm trigger 214 by outputting drive signals 312 to one or more drivers 320 so as to activate one or more of the alarms 340. The alarms 340 may be any of various audible transducers, such as speakers, piezoelectric transducers, buzzers or bells to name a few.

[0024] As shown in FIG. 3, circuit testers 330 are in electrical communication with the drivers 320 so as to verify the integrity of the drive circuits between the drivers 320 and the alarms 340. Circuit testers 330 provide one or more circuit function signals 332 to the alarm controller 310, which the alarm controller 310 utilizes to indicate and adapt to subsystem malfunctions, as described above. A circuit tester embodiment is described with respect to FIG. 4, below.

[0025] Also shown in FIG. 3, alarm detectors 350 interface with the alarms 340 so as to verify the integrity of the alarm transducers. Alarm detectors 350 provide one or more alarm function signals 352 to the alarm controller 310, which the alarm controller 310 utilizes to indicate and adapt to subsystem malfunctions, as described above. Alarm detector embodiments are described with respect to FIGS. 5-9, below.

[0026] In one embodiment, each alarm 340 has a corresponding alarm detector 350 so that the alarm controller 310 can identify a specific malfunctioning alarm. In another embodiment, a robust alarm system 300 may have one alarm detector 350 for multiple alarms 340 that each output a unique audio frequency or frequency spectrum so as to distinguish a malfunctioning alarm. In yet another embodiment, a robust alarm system 300 may have one alarm detector 350 for all alarms 340, where each alarm is sequentially and briefly activated during a periodic or intermittent testing procedure so as to determine the existence of any malfunctioning alarms. In this manner, the detector 350 provides the alarm controller 310 with sequential alarm function signals 352. Advantageously, a combination of alarm redundancy, a drive circuit integrity check and an alarm integrity check increases overall alarm reliability.

[0027] FIG. 4 illustrates a driver embodiment 420 and a corresponding circuit tester embodiment 430. The driver 420 comprises an oscillator 422 responsive to a drive signal 312 and a power amplifier 424 that drives a speaker 440. An alarm sounds when the alarm controller 310 (FIG. 3) activates the drive signal 312 and the speaker 440 generates a tone at the oscillator frequency. The circuit tester 430 comprises a resistor R 432 and a differential amplifier 434. The resistor 432 senses the power amplifier current flowing through the speaker coil, and the differential amplifier 434 amplifies the corresponding voltage drop across the resistor 422 providing a square wave, for example, as a circuit function signal 332 to the alarm controller 310 (FIG. 3). The alarm controller 310 (FIG. 3) verifies the integrity of the circuit between driver 420 and alarm 440 by sensing a square wave in the circuit function signal 332 when the drive signal 312 is active. Likewise, the alarm controller 310 (FIG. 3) senses a circuit malfunction if the circuit function signal 332 is a DC level or random noise when the drive signal 312 is active, such as when the tone generator or power amplifier are non-functional or when the drive circuit is open loop due to coil wire breakage. The circuit tester 430, however, cannot verify alarm integrity, i.e. that the speaker 440 is actually generating sound in response to drive current through an intact speaker coil. For example, the speaker cone may be detached from the speaker coil or otherwise damaged. Alarm detectors 350 (FIG. 3) that can verify alarm integrity are described with respect to FIGS. 5-9, below.

[0028] FIG. 5 illustrates one embodiment of an alarm detector 350 (FIG. 3) that can verify alarm integrity. An acoustic sensor 550, such as a microphone, is configured to detect sound waves 501 generated by the alarm transducer 340 (FIG. 3), such as a speaker. An amplifier 510 generates a corresponding alarm function signal 352 to the alarm controller 310 (FIG. 3). If the alarm 540 is operative, the alarm controller 310 (FIG. 3) can detect a corresponding tone waveform in the alarm function signal 352 upon activation of the drive signal 312 (FIG. 3). Otherwise, an alarm malfunction is determined and the alarm controller 310 (FIG. 3) responds accordingly, such as generating a malfunction signal 216 (FIG. 3) or activating a redundant alarm 340 (FIG. 3) or both.

[0029] FIG. 6 illustrates another embodiment of an alarm detector 350 (FIG. 3). A piezoelectric device 650 is configured to sense vibrations from a functioning acoustic transducer, such as a speaker 640. In particular, the piezoelectric device 650 is attached to or otherwise mechanically coupled to an acoustic transducer, such as a speaker 640. If the alarm 640 is operative, the alarm controller 310 (FIG. 3) can detect a corresponding vibration waveform in the alarm function signal 352 upon activation of the drive signal 312 (FIG. 3). Otherwise, an alarm malfunction is determined and the alarm controller 310 (FIG. 3) responds accordingly.

[0030] FIG. 7 illustrates a further embodiment of an alarm detector 350 (FIG. 3). An ultrasound transmitter 760 and corresponding ultrasound receiver 750 are configured to sense movement from a functioning acoustic transducer, such a speaker 740. In particular, the transmitter 760 is adapted to transmit an ultrasound wave 701 to the speaker cone 742. The receiver 750 is adapted to measure a return ultrasound wave 702 reflected off of the cone 742. If the speaker cone 742 is in motion, the return ultrasound wave 702 is phase shifted from the transmitted ultrasound wave 701 due to changes in the ultrasound wave path length and frequency shifted due to the Doppler effect. If the speaker cone 742 is motionless, the return ultrasound wave 702 is a steady sinusoidal with the same frequency as the transmitted ultrasound wave 701. Thus, if the alarm 740 is operative, the alarm controller 310 (FIG. 3) can detect these phase and frequency shifts as reflected in the alarm function signal 352 upon activation of the drive signal 312 (FIG. 3). Otherwise, an alarm malfunction is determined and the alarm controller 310 (FIG. 3) responds accordingly.

[0031] FIG. 8 illustrates yet another embodiment of an alarm detector 350 (FIG. 3). An LED emitter 860 and a photodiode sensor 850 are configured to sense movement from a functioning acoustic transducer, such a speaker 840. In particular, a DC signal is applied to the LED 840, which is adapted to emit light 801 so as to illuminate a portion of the speaker cone 842. The photodiode 850 is adapted to detect the intensity of light reflected 802 off of the speaker cone 842. If the speaker cone 842 is in motion, the light intensity at the photodiode 850 will have an AC component because of changes that occur in the LED-photodiode focal point and optical path. Further, if the speaker cone 842 has small excursions, the AC component of the light intensity at photodiode will have a frequency spectra corresponding to that of the speaker 840, which allows the sound frequency spectra generated by the speaker 840 to be verified. If the speaker cone 842 is motionless, the light intensity at the photodiode will be a DC value. Thus, if the alarm 840 is operative, the alarm controller 310 (FIG. 3) can detect these phase and frequency shifts as reflected in the alarm function signal 352 upon activation of the drive signal 312 (FIG. 3). Otherwise, an alarm malfunction is determined and the alarm controller 310 (FIG. 3) responds accordingly. In an alternative embodiment, a modulated signal is applied to the LED 860 and a corresponding demodulation is applied to the photodiode 850 so as to detect the AC component due to speaker cone motion.

[0032] FIG. 9 illustrates an additional embodiment of an alarm detector 350 (FIG. 3). A sensing coil 944 is configured to sense movement in a functioning acoustic transducer, such a speaker 940. In particular, the sensing coil 944 is placed in tandem with the speaker coil 942 so that movement of the speaker cone resulting from drive current in the speaker coil 942 induces current in the sensing coil 944. That is, movement of the sensing coil 944 through the field of the speaker magnet results in a corresponding current in the sensing coil 944. Thus, if the speaker 940 is operative, the alarm controller 310 (FIG. 3) can detect the sensing coil 944 current in the alarm function signal 352 upon activation of the drive signal 312 (FIG. 3) and a corresponding tone generator input 901 to the speaker amplifier 924. Otherwise, an alarm malfunction is determined and the alarm controller 310 (FIG. 3) responds accordingly.

[0033] FIG. 10 illustrates a pulse oximeter 1000 comprising a portable instrument 1001 and a corresponding docking station 1002. Advantageously, when the portable instrument 1001 is docked, the pulse oximeter 1000 has redundant alarms 1050, 1070 that are activated concurrently so as to provide a robust alarm system. In particular, failure of one alarm does not silence an audible indication of a measured parameter outside of preset limits, such as during a desaturation event. Further, concurrent activation of the alarms 1050, 1070 provides a stereo-like directional resolution that allows a caregiver in a large ward to more readily locate the pulse oximeter and the patient corresponding to the alarm.

[0034] As shown in FIG. 10, the portable instrument 1001 has a signal processor 1020 in communications with a sensor 1010, a management processor 1030, a display 1040 and an alarm A 1050. The signal processor 1020 functions in conjunction with the sensor 1010 to determine oxygen saturation, pulse rate and related parameters, as described above. These results are communicated to the display 1040 and alarm A 1050 via the management processor 1030. The docking station 1002 has a processor 1060, an alarm B 1070 and various visual status indicators 1080. The portable instrument 1001 and docking station 1002 communicate across a mechanical and electrical interface 1005 via their respective processors 1030, 1060. In particular, an alarm condition determined by the portable's management processor 1030 is communicated to the docking station processor 1060 for concurrent activation of alarms A and B 1050, 1070. A pulse oximetry comprising a portable instrument and a docking station are described in U.S. Pat. No. 6,584,336 entitled Universal/Upgrading Pulse Oximeter, which is assigned to Masimo Corporation, Irvine, Calif. and incorporated by reference herein.

[0035] A pulse oximeter having a robust alarm system is described above as a combination portable instrument and docking station having multiple, concurrently activated alarms. In other embodiments, a pulse oximeter having multiple, concurrently activated alarms may be a single standalone instrument, handheld or plug-in module, as further examples. A robust alarm system is also described above as having audible alarm transducers and corresponding alarm detectors. In other embodiments, the alarms may be audible or visual or a combination of both and the alarm detectors may be any of various optical devices for verifying operation of visual indictors or displays.

[0036] A robust alarm system has been disclosed in detail in connection with various embodiments. These embodiments are disclosed by way of examples only and are not to limit the scope of the claims that follow. One of ordinary skill in art will appreciate many variations and modifications.