Means system and method for operating an apparatus

[0002] 1. Field of the Invention

[0003] The present invention is directed to a means, a system and a method for operating an apparatus, particularly a complex medical apparatus such as, for example, a tomography apparatus or an angiography apparatus. The term “operating” with respect to this invention is to be understood in the broadest sense and includes, in particular, the control, adjustment, maintenance, adaptation and/or monitoring of the apparatus.

[0004] 2. Description of the Related Art

[0005] Complex apparatus like those cited above require regular maintenance. Specific programs have been utilized for such maintenance, these programs making it possible—when used by the maintenance engineer—to implement measurements, set internal parameters or execute other functions.

[0006] Such specifically programmed maintenance applications, however, have little flexibility when the user interface is to be redesigned or some other computer platform is to be utilized. If remote maintenance of the apparatus is to be performed, a display rerouting must be set up at a high cost.

[0007] HTML documents (HTML=Hypertext Markup Language; text marking language with cross-reference functions) are a known user interface on, for example, the Internet. These HTML texts are retrieved from a WWW server (WWW=World Wide Web), loaded into a WWW browser and displayed by the latter, as is known.

[0008] This way of implementing a user interface, however, has only been used until now for simple and non-critical control tasks. Security-related or interactive functions, as are indispensable for the maintenance of complex systems, have not been capable of being realized or were only inadequately realized. A reliable access protection against unauthorized use, a reasonable handling of hardware faults, for example connection aborts, and the possibility of being able to interactively influence the execution of a program are thereby important aspects for such complex systems.

[0009] The meanings of the terms “browser” and “browsing” as used herein are presented on page 125 of the publication LEXIKON DERINFORMATIK UNDDATENVERARBEITUNG, H. -J. Schneider, Ed., 3rd Edition, Oldenbourg Verlag, Munich 1991.

[0010] The article, “The Ultimate Middleware” by John Kador in the periodical BYTE, April 1996, pp. 79-83, describes the employment of services of the WWW (World Wide Web) as a replacement for what is referred to as “middleware” in order to interrogate central data banks. The structure of such systems is only superficially described. The use of middleware for operating an apparatus is not disclosed.

[0011] U.S. Pat. No. 5,572,652 discloses a work station computer wherein passwords are employed for different access authorization levels.

[0012] Pages 7-73 and 7-74 of the report, “Mikrocomputer in der Sicherheitstechnik” by H. Hölscher and J. Rader, Verlag T{umlaut over (U)}V Rheinland, Cologne 1984, describe a method of temporal program run monitoring wherein a “watchdog time” outputs an alarm or shuts the system off when it is not retriggered by a suitable program instruction within a predetermined time window.

[0013] Accordingly, the present invention is based on the object of solving these problems and providing a means, a system and a method in order to realize a user interface with security-related functions or interactive functions where the user interface is flexible and requires little programming outlay. In particular, standard modules should be utilized to a large extent in the user interface insofar as possible.

[0014] This and other objects and advantages of the intention are achieved by a device for operating an apparatus, including a server that is configured for sending data to a connectable browser and receiving data therefrom, a monitoring module, means for communicating between the server and the monitoring module, a plurality of control, maintenance and/or monitoring programs, and means for communicating between the control, maintenance and/or monitoring programs on the one hand as well as the server and/or the monitoring module on the other hand.

[0015] A system for the operation of an apparatus is also provided, including a device as set forth above and a browser connected to the server via an interface, the browser providing a user interface.

[0016] The present invention also provides a method for the operation of an apparatus, including the steps of: receiving a message deriving from a browser with a server; calling a program with the server; communicating by the program called by the server with a monitoring module; and calling or aborting a control, maintenance and/or monitoring program by the program called by the server or by the monitoring module.

[0017] The inventive means thereby comprises the server-side components of the system to which a known browser can be connected.

[0018] The invention is based on the fundamental idea of providing a central monitoring module (or “watchdog”) at the server side that is informed of all significant events in the system and that realizes the desired functions in collaboration with the browser and the further system components.

[0019] The present invention makes it possible to also utilize the above-described technique of implementing a user interface with HTML documents for complex apparatus for which security-related functions or interactive functions are required. The invention can be utilized for all types of apparatus.

[0020] Since there are highly convenient development tools for HTML documents, the user interface can be directly designed as an HTML document by an HTML designer and can be easily modified as needed. The previously required step of programming the user interface is eliminated.

[0021] The data exchange between the server and the browser is possible in many ways via an interface. The browser can be connected locally to the apparatus, for example via a connecting cable. In the extreme case, the server and the browser are run as two processes on a single computer. A non-local connection (for example, a modem connection) is also possible without requiring individual programming because WWW servers and WWW browsers are already designed for use in a client-server mode from the very outset.

[0022] The invention preferably exhibits one or more of the following three aspects, which are not necessarily bound to the inventive system structure:

[0023] 1. Access control to the individual apparatus functions,

[0024] 2. Recognition of connection aborts, or crashes, and

[0025] 3. Offering interactive functions.

[0026] For access control, server-side components of the system are preferably configured for implementing an authentication of the authorization of a user. To that end, the user enters his or her user name and a password. The user is granted access to the user interface only after a successful authentication.

[0027] Different access authorization levels can preferably be assigned to different users, so that, for example, specific functions can only be executed by users who are specifically authorized for the function. The apparatus to be operated can also be set to different enable levels. The HTML pages displayed for the user are preferably dynamically adapted to the user's access authorization.

[0028] The recognition of connection aborts, or crashes, preferably ensues in that the ongoing arrival of periodic message (“ping messages”) sent by the browser is monitored. When the ping messages fail to arrive, all running processes are preferably aborted.

[0029] Interactive functions, which in particular include the possibility of being able to abort running processes at any time and with little delay, are preferably offered in that an interactive-bidirectional connection is maintained between the user interface and the running process via the monitoring module.

[0030] HTML documents are preferably employed for implementing the user interface; however, other page description languages can also be utilized. Likewise, other servers and browsers can be utilized instead of the known WWW servers and WWW browsers. The server preferably starts programs via a CGI interface (CGI=Common Gateway Interface, a standard interface in WWW servers for calling external programs) or in some other suitable way.

[0031] The inventive method is based on the fundamental principle of providing a program called by the server that exchanges data with the watchdog module and then executes a desired action. The aforementioned functions can thus be achieved with little programming outlay.

[0032] Further preferred developments of the invention are provided by a device which has the monitoring module configured for storing and continuously updating a directory of the respectively active control, maintenance and/or monitoring programs. The monitoring module and/or an authentication program called by the server is/are configured for implementing an authentication of a user.

[0033] A connection program called by the server is configured for implementing an inquiry at the monitoring module with respect to the authorization of a user for implementing one of the control, maintenance and/or monitoring programs and, as warranted, for starting this control, maintenance and/or monitoring program.

[0034] The monitoring module and/or a ping program called by the server is/are configured for identifying the failure of periodic ping messages received by the server to arrive and of subsequently causing that all active control, maintenance and/or monitoring programs are aborted. The monitoring module and/or an abort program called by the server is/are configured for initiating—as a reaction to an abort message received from the server—that at least one of the control, maintenance and/or monitoring programs as well as, potentially, an allocated connection program is aborted. The monitoring module and/or a program called by the server is/are configured for forwarding a message received by the server to an allocated control, maintenance and/or monitoring program. Preferable, the programs called by the server are CGI programs. The data sent and received by the server via the interface are HTML data in the preferred embodiment.

[0035] The system of a preferred embodiment provides that the browser is configured for implementing a ping process that periodically sends a ping message to the server.

[0036] In the method, an additional step is preferred, namely, updating a directory of the active control, maintenance and/or monitoring programs with the monitoring module.

[0037] An exemplary embodiment of the invention that the inventors currently consider the best way of implementing the invention is described with reference to the drawings. A maintenance system for a medical apparatus is thereby involved.

[0038] FIG. 1 is a dataflow diagram of the inventive system;

[0039] FIG. 2 is a status transition diagram of a typical execution of the inventive system; and

[0040] FIGS. 3 and 4 are dataflow diagrams when starting and aborting a maintenance program.

[0041] Below the broken line, FIG. 1 shows those components of the inventive system that are allocated to a central host computer 18 of the apparatus to be operated (server-side components). A WWW server 10 is capable of calling connection programs 12 via a CGI interface. The connection programs 12 in turn start maintenance programs 14 and are connected to these during the program execution via the IPC mechanism (IPC=Inter-process communication; communication between processes).

[0042] Each maintenance program 14 executes one or more maintenance functions and calls control programs of the apparatus to be operated via the RPC mechanism (RPC=remote procedure call; non-local procedure call). The control procedures 16 are parts of the control of the apparatus to be operated; for example, they serve for the implementation of measurements at hardware assemblies.

[0043] The server 10, the maintenance programs 14 and the control processes of the apparatus to be operated are connected to one or more data banks that contain global control data for the apparatus to be operated, maintenance results, handbook datafiles (help files), etc.

[0044] A central monitoring module 20 comprises a directory 22 of currently active programs (connection programs 12, maintenance programs 14 and other programs) and is connected by the IPC mechanism to the connection programs 12 as well as lo a start program 24, an authentication program 26, a ping program 28 and an abort program 30. The latter four programs are in turn called via the CGI interface of the server 10. In collaboration with the CGI programs 12, 24, 26, 28 and 30 and with the server 10, the monitoring module 20 executes a plurality of monitoring and administration tasks, these being described in greater detail below.

[0045] An interface 32 connects the server 10 to a WWV browser 40 that is shown above the broken line in FIG. 1. The connection between the server 10 and the browser 40 ensues via the HTTP protocol (HTTP=hypertext transfer protocol). In the exemplary embodiment described here, the browser 40 is locally allocated to the apparatus to be operated. In an alternative embodiment, the browser 40 is installed on an external computer, for example on a standard notebook computer that is connected to the server 10 via a PPP connection (PPP=point-to-point protocol). A protection against faulty transmission of manipulations can be achieved by checksums or by an encryption of the transmitted data.

[0046] The browser 40, for example that is known under the trademark “Netscape Navigator”, is capable of displaying ASCII and HTML pages, of executing programs in JAVA and JAVASCRIPT and of communicating inputs of the user to the server 10. As its principal job, the browser 40 makes a user interface for the apparatus to be operated available by displays of a specific HTML maintenance page. Moreover, an online documentation as well as further programs can be called via the browser 40.

[0047] The HTML maintenance page displayed by the browser 40 is logically divided into a visible frame 42, a first static frame 44 hidden from the user, and a hidden, second static frame 46 with temporary content. The invisible frames 44 and 46 contain data, JAVASCRIPT programs and JAVA applets.

[0048] The HTML maintenance page is completely loaded into the browser 40 only a single time, namely at the beginning of the maintenance event. Later, only the visible frame 42 and the content of the second, static temporary frame 46 are overwritten. The static frame 44 is not overwritten during the maintenance event, so that the data stored in it are preserved. The information displayed in the visible frame 42 and stored in the first static frame 44 can be modified by suitable JAVASCRIPT programs, JAVA applets or other means. The second static frame 46 is loaded in order to modify variables and/or fields in the first static frame 44 and/or in the visible frame 42. Preferably, a new HTML page is loaded into the second static frame 46 with JAVA-script programs, JAVA applets or other means and is automatically executed. Above all, the HTML page is also dynamically generated by a CGI program. The advantage of the second static frame 46 is comprised therein that the complete frames 42 and 44 need not be transmitted from the server 10 for updating the visible frame 42 and the first static frame 44; rather, only the variables therein have to be set. Faster transmission times derive therefrom since only changes are transmitted. Moreover, a visible reloading of the visible frame 42, which is disturbing for the user, is avoided.

[0049] First, frequently required auxiliary programs are stored in the static, hidden frame 44; in this way, these do not have to be repeatedly loaded. Second, this frame serves the purpose of storing global values that should be preserved during the entire system running time, for example a session-dependent key that is transmitted to the browser 40 during the starting of the system. Third, this frame contains a ping process 48 as JAVASCRIPT program or JAVA applet that outputs periodic ping messages to the server 10. These components are described in greater detail below.

[0050] The state transition diagram shown in FIG. 2 represents the states during the operation of the described exemplary embodiment and the events (transitions) that connected these states. When the system is brought up, the server 10 is started first and then the monitoring module 20 and, thus, the state 50 is run through and the state 52 is reached. The occurrence of an error leads to an error state 54 that can in turn be left by a manual resetting.

[0051] The browser 40 is called (at state 56) in response to a command of the user to start the user interface and the browser 40 sends a corresponding message to the server 10 via the interface 32. The server 10 subsequently calls the start program 24 that in turn informs the monitoring module 20 via IPC. Since the example presented here is a matter of a locally connected browser 40, the authentication of the user must still ensue. This information is returned to the server 10 that, in response thereto, communicates a general HTML start page to the browser 40 that is displayed to the user.

[0052] When the user would like to access the maintenance functions of the system from the general HTML start page, he must enter his user name and a password for the authentication (at the state 58). The browser 40 communicates these via the interface 32 to the server 10 and from the latter to the authentication program. The latter checks the input authentication data according to a plurality of criteria, potentially in consultation with further programs.

[0053] System-dependent, variable passwords with an adjustable validity duration are employed. Moreover, different access authorization levels are assigned to different users, so that specific functions can only be called by specifically authorized users. The possible functions for a user, moreover, are dependent on an enable level set at the apparatus to be operated that can be changed at any time. The monitoring module 20 has access to the respectively current enable level. For example, specific maintenance functions can be enabled only given a locally connected browser 40.

[0054] When the authentication is successful, the server 10 communicates the HTML maintenance page with which the user interface is implemented (at the state 60) to the browser 40. Further, the monitoring module 20 generates a session-dependent key that also indicates the access authorization level that was identified. This key is loaded into the temporary frame 46 in the form of a JAVA script and, potentially, of a JAVA applet, whereby the JAVA script or, respectively, correspondingly sets a variable contained in the static frame 44.

[0055] The browser 40 need not be locally connected to the browser 40. For example, the communication between the server 10 and the browser can ensue via a PPP modem connection in an alternative embodiment. The authentication of the user then already occurs upon setup of the PPP connection, so that no further password input is required for starting the user interface. This is determined by the start program 24 when starting the browser 40, this start program 24 seeing to it that the HTML maintenance page as well as the session-dependent key are directly communicated to the browser 40 (in the state 60).

[0056] The key stored in the static frame 44 of the HTML maintenance page influences the further execution of the maintenance event in a number of respects. First, JAVA script programs or JAVA applets that modify the configuration of the pages displayed to the user that depend on the access authorization level can be contained in the HTML datafiles communicated to the browser 40 from the server 10 during the further execution. For example, it can be provided that individual pages are only displayed in the visible frame or individual functions can only be selected by the user given that the user has the appropriate specific access authorization level. Moreover, the key is repeatedly transmitted to the server 10 and serves as password in the server. The actual user password therefore only has to be input once in the authentication, even when the server 10 requests a password more frequently. The server-side components of the system also employ the key in order to dynamically adapt the HTML data transmitted to the browser 40 to the access authorization of the user and to the momentary enable level of the apparatus to be operated.

[0057] As the next step of the system execution, the ping process transmitted to the browser 40 with the static, hidden frame 44 is started and the state 62 is thus reached. From now on, the ping

[0058] process continuously sends ping messages to the server 10 via the interface 32 at predetermined time intervals. Each received ping message effects a calling of the ping program 28 via the CGI interface of the server 10, which in turn sends a corresponding message to the monitoring module 20 via IPC. The evaluation of the received ping messages shall be discussed later.

[0059] In the central state 62, suitable information are displayed for the user in the visible frame and options are provided for selection depending on the access authorization level of the user and the enable level of the apparatus to be operated. 15 In particular, the user can start a maintenance program 14 by selecting a corresponding option. Given this event, which is shown in greater detail in FIG. 3, the browser 40 sends a suitable message to the server 10 (data stream 80), as a result whereof a connection program 12 is called (data stream 82). First, this inquires of the monitoring module 20 (data stream 84) whether the user has the authorization to execute the requested maintenance program 14. This authorization depends of the access authorization level of the user and on the enable level of the apparatus to be operated.

[0060] When the user is authorized (data stream 86), the connection program 12 starts the selected maintenance program 14 (data stream 88) and reports its process indicator to the monitoring module 20 (data stream 90). The monitoring module 20 notes this process indicator in the directory 22. The state 64 shown in FIG. 2 has thus been reached. In the described exemplary embodiment, however, the states 62 and 64 are not strictly separated since, as shown in FIG. 1, it is possible to start a plurality of maintenance programs 14 and have them run in parallel or quasi-parallel.

[0061] When the maintenance program 14 ends without the user having given an abort command, then this is reported to the connection program 12 (data stream 92 in FIG. 3). The end status of the maintenance program 14 is forwarded via the server 10 to the browser 40 (data streams 94 and 96). Moreover, the connection program 12 informs the monitoring module 20 (data stream 98), which deletes the program indicator of the ended maintenance program 14 from the directory 22.

[0062] In addition to the program end that was just described and that is effected by the maintenance program 14 itself, the user—by selecting an instruction area shown in the visible window 42—can give a command (such as an “abort command”) for the regular abort of one, some or all maintenance programs 14 as well as the allocated connection programs 12. The programs are thereby “cleanly” terminated and ended. This operation is shown in greater detail in FIG. 4.

[0063] The abort command given by the user is again communicated to the server 10, then via the CGI interface to the abort program 30 and from the latter to the monitoring module 20 (data streams 100, 102 and 104). When, for example, a single maintenance program 14 is to be aborted, then the monitoring module 20 identifies its process indicator as well as the appertaining connection program 12. A suitable abort request is then sent to this connection program 12 and to the maintenance program 14 (data streams 106 and 108). The state 66 in FIG. 2 is thus reached.

[0064] When the maintenance program 14 correctly reacts to the abort request, then it ends itself and it also potentially ends an allocated control process 16 and reports this to the connection program 12 (data stream 110), which in turn informs the monitoring module 20 (data stream 112) and the likewise ends itself. A time error in the abort is recognized when the abort confirmation does not arrive at the monitoring module 20 within a predetermined time span (state 68 in FIG. 2). In this case, the monitoring module 20 implements a forced program abort in that it send a corresponding command (referred to as a “kill” command) to the connection program and to the maintenance program 14.

[0065] The result of the regular or forced abort is reported from the monitoring module 20 to the abort program 30, to the server 10 and to the browser 40 (data streams 114, 116 and 118). The monitoring module 20 thereby deletes the aborted program from its directory 22.

[0066] The mechanism presented here with reference to the example of a program abort can be generally employed in order to communicate input data to running maintenance programs 14 and, thus, to allow an interactive operation of a program via a browser 40. The basic principle is thereby to route the input data to the monitoring module 20 via a program called by the server 10, preferably a CGI program. The latter thereby identifies the momentarily active program for which the input data are intended and routes them thereto, potentially via a connection program allocated to this program.

[0067] While the maintenance program is active and the ping process 48 of the browser 40 is running, i.e. in the states 62 through 68 shown in FIG. 2, the monitoring module 20 continuously checks whether the most recently received ping message lies no longer than a predetermined time duration in the past. A failure of the ping messages to arrive at the monitoring module 20 (ping time error) indicates a malfunction, typically a crash of a computer, a program abort or a loss of the communication connection between the server 10 and the browser 40 (state 70).

[0068] When the monitoring module 20 recognizes a ping time error, then it ends all active connection programs 12 and maintenance programs 14 in the above-described way, as though the user had given a command for the regular abort of all active programs. The system switches into the state 52 and waits for a new start instruction.

[0069] In the described system, the monitoring module 20 is a central process that has access to all information about the current system status. The monitoring module 20 can therefore fulfill a number of other tasks. For example, the enable level of the apparatus to be monitored can change during the maintenance event. The monitoring module subsequently decides which of the maintenance programs 14 that are active at the time can continue to be executed. As warranted, the monitoring module 20 aborts the maintenance programs that are no longer authorized to run in the way presented above.

[0070] The inventive system, which is provided as maintenance system for a medical apparatus in the exemplary embodiment described here, can likewise be utilized for the control, adjustment, maintenance, adaptation or monitoring of all types of technical apparatus. All suitable communication means, for example the Internet or an intranet as well, can be utilized for the connection between the server 10 and the browser 40.

[0071] Although other modifications and changes may be suggested by those skilled in the art, it is the intention of the inventors to embody within the patent warranted hereon all changes and modifications as reasonably and properly come within the scope of their contribution to the art.