System and method for recovery from memory errors in a medical device

[0001] This patent application relates generally to implantable medical devices and, in particular, but not by way of limitation, to a system and method for reducing the susceptibility of the devices to single event upsets.

[0002] Implantable medical devices (IMDs) are devices designed to be implanted into a patient. Some examples of these devices include cardiac rhythm management devices such as implantable pacemakers and implantable cardioverter defibrillators (ICDs). The devices are used to treat patients using electrical therapy and to aid a physician or caregiver in patient diagnosis through internal monitoring of a patient's condition. The devices may include electrical leads in communication with sense amplifiers to monitor electrical heart activity within a patient, and often include sensors to monitor other internal patient parameters. Other examples of implantable medical devices include implantable insulin pumps or devices implanted to administer drugs to a patient. IMDs often include microcontrollers or microprocessors along with memory to store program instructions and data. Corruption of data in the memory can lead to erroneous operation of an IMD.

[0003] This document discusses, among other things, systems and methods for detecting and correcting memory errors in implantable medical devices when the devices are exposed to high-energy radiation environments. In one system example, the system comprises an implantable medical device that includes at least one electrical input to receive sensed electrical activity of a heart of a patient, a memory, and a controller circuit. The controller circuit is coupled to the electrical input and memory and is operable to enter a memory scrubbing mode that increases a rate of detecting and correcting single bit errors in the memory when the controller circuit determines the implantable device is in a high-energy radiation environment.

[0004] Another example includes a method that comprises determining that an implantable medical device is in a high-energy radiation environment, enabling a memory scrubbing mode in response to the implantable medical device entering the high-energy radiation environment, and increasing a rate of detecting and correcting memory errors in the device upon the enabling of the scrubbing mode. Other examples and advantages are also discussed in the following detailed description and represented in the drawings that form a part thereof.

[0010] In the following detailed description, reference is made to the accompanying drawings which form a part hereof, and specific embodiments in which the invention may be practiced are shown by way of illustration. It is to be understood that other embodiments may be used and structural changes may be made without departing from the scope of the present invention.

[0011] The present application discusses, among other things, systems and methods for detecting and correcting memory errors in implantable medical devices (IMDs) when the devices are exposed to high-energy radiation environments.

[0012] Cancer is a common co-morbidity among patients who use IMDs. These patients may be exposed to high-energy radiation cancer therapy. As medical technology continues to improve, patients with IMDs will live longer and the likelihood that they could also become cancer patients increases. Exposure to radiation therapy increases the likelihood that the implanted devices will experience memory failures. These memory failures may be in the form of single event upsets that corrupt random access memory (RAM). The memory failures can occur in memory locations containing operating parameters of the IMD or in memory locations containing program instructions. These failures may require explanting an IMD from the cancer patient. Manufacturers of IMDs typically label the devices to warn a physician or technician to shield the device during the radiation therapy. However, device failure from memory corruption may still occur from exposing the IMD to backscattered particles during the radiation therapy.

[0013] FIG. 1 illustrates an embodiment of a system 100 that uses an implantable medical device (IMD) 105. The system 100 shown is one embodiment of portions of a system 100 used to treat a cardiac arrhythmia. A pulse generator (PG) or other IMD 105 is coupled by a cardiac lead 110, or additional leads, to a heart 115 of a patient 120.

[0014] Examples of IMD 105 include, without limitation, a pacer, a defibrillator, a cardiac resynchronization therapy (CRT) device, or a combination of such devices. This document relates to any IMD that can transmit data while implanted in a human or animal patient 120 and is not limited only to devices that deliver electrical therapy through leads. This also includes IMDs that are purely diagnostic in nature such as devices implanted to communicate diagnostic data to an external device. This further relates to IMDs that deliver a drug therapy to a patient.

[0015] Cardiac lead 110 includes a proximal end 135 that is coupled to IMD 105 and a distal end 140, coupled to one or more portions of a heart 115. System 100 also includes an IMD programmer or other external device 125 that provides wireless communication with the IMD 105, such as by using a telemetry device 130. One embodiment of wireless communication by telemetry is communication using radio frequency (RF) signals. Another embodiment is communication using infrared light signals. Yet another embodiment is communication using coils electrically coupled with mutual inductance. In one example of an external device 125, the external device 125 is able to communicate one or more operational parameters to the implantable device 105 in order to program the IMD 105. If the IMD patient 120 is also a cancer patient, the patient 120 as well as the IMD 105 may be exposed to high-energy radiation therapy 160 as part of cancer treatment.

[0016] FIG. 2 illustrates an IMD 105 coupled by one or more leads 110A-B to heart 115. Heart 115 includes a right atrium 200A, a left atrium 200B, a right ventricle 205A, a left ventricle 205B, and a coronary sinus 220 extending from right atrium 200A. In this embodiment, atrial lead 110A includes electrodes (electrical contacts, such as ring electrode 225 and tip electrode 230) disposed in, around, or near an atrium 200 of heart 115 for sensing signals and/or delivering pacing therapy to the atrium 200. Lead 110A optionally also includes additional electrodes, such as for delivering atrial and/or ventricular cardioversion/defibrillation and/or pacing or resynchronization therapy to heart 115.

[0017] Ventricular lead 110B includes one or more electrodes, such as tip electrode 235 and ring electrode 240, for delivering sensing signals and/or delivering pacing therapy. Lead 10B optionally also includes additional electrodes, such as for delivering atrial and/or ventricular cardioversion/defibrillation and/or pacing therapy to heart 115. IMD 105 includes components that are enclosed in a hermetically-sealed housing or “can” 250. Additional electrodes may be located on the can 250, or on an insulating header 255, or on other portions of IMD 105, for providing unipolar pacing and/or defibrillation energy in conjunction with the electrodes disposed on or around heart 115. Other forms of electrodes include meshes and patches which may be applied to portions of heart 115 or which may be implanted in other areas of the body to help “steer” electrical currents produced by IMD 105. In one embodiment, one of atrial lead 110A or ventricular lead 110B is omitted, i.e., a “single chamber” device is provided, rather than the dual chamber device illustrated in FIG. 2. In another embodiment, additional leads are provided for coupling the IMD 105 to other heart chambers and/or other locations in the same heart chamber as one or more of leads 110A-B. The present methods and systems will work in a variety of configurations and with a variety of electrical contacts or “electrodes.”

[0018] FIG. 3 shows an exemplary embodiment of an IMD 300 that is coupled to one or more leads, such as bipolar leads 360, 365. The bipolar leads 360, 365 include tip electrodes 305A, 305B and ring electrodes 310A, 310B. The IMD 300 includes a therapy circuit 315 to deliver electrical therapy to heart 115 through the leads 360, 365 and electrodes and a sensing circuit 320 to sense electrical signals on the leads 360, 365 and electrodes. To sense the electrical signals, the sensing circuit 320 includes sense amplifier circuits coupled to the switch network 325. The switch network 325 is also operable to couple the sensing circuit 320 to any combination of one or more electrodes. The switching network 325 further couples the therapy circuit 315 to the electrodes.

[0019] Typically, the IMD 300 delivers therapy through the leads or senses voltages on the leads, such as between the tip electrodes 305A, 305B and ring electrodes 310A, 310B. The IMD 300 includes a controller circuit 330 that is operable to connect the therapy circuit 315 and/or sensing circuit 320 to the electrodes through the switch network 325. In one embodiment, the controller circuit 330 is operable through logic circuits implementing a state-machine in hardware. In another embodiment, controller circuit 330 includes a processor executing instructions contained in firmware. In yet another embodiment, the controller circuit 330 includes a processor executing software instructions. In yet another embodiment, the controller circuit 330 includes any combination of hardware, software and/or firmware.

[0020] The IMD 300 also includes a memory circuit 340 coupled to the controller circuit 330. In one embodiment, the memory circuit 340 includes data storage for storing operating parameters of the IMD 300. In another embodiment, the memory 340 includes firmware or volatile memory such as random access memory (RAM) containing instructions executable by the controller circuit 330. In another embodiment, the memory circuit 340 includes hardware registers accessible by the controller circuit 330. If the IMD patient is also a cancer patient, exposure to high-energy radiation therapy increases the likelihood that the IMD 300 will experience memory failures due to single event upsets (SEUs). An SEU is a problem that occurs when high density electronics are subjected to radiation fields. For example, an alpha particle impinging on a semiconductor substrate of the memory 340 may generate electron-hole pairs that corrupt data stored as a charge on a capacitive element. The memory location corrupted may contain an operating parameter or an executable instruction. This could lead to device failure, possibly requiring explanting the IMD 300 from a patient.

[0021] To mitigate memory failures in the IMD 300, the controller circuit 330 is operable to enter a “memory scrubbing” mode where the controller circuit 330 detects and corrects memory errors. In normal operation, the controller circuit 330 checks for memory errors in the memory locations it accesses. When in memory scrubbing mode, the controller circuit 330 systematically checks locations in memory 340 for memory errors; even those memory locations not accessed in normal operation. Systematically checking refers to any systematic or uniform method of ensuring that all memory locations are checked, such as, for example, by incrementing an address. In one embodiment, the controller circuit 330 also systematically checks memory 340 for errors once-per-day when not in the memory scrubbing mode. This is done to correct rare errors that may occur due to normal background radiation levels. However, when the controller circuit 330 enters the memory scrubbing mode, the controller circuit 330 increases a rate of checking for errors. In one embodiment, the controller circuit 330 checks all memory at a rate of once-per-second while in memory scrubbing mode. In another embodiment, the controller circuit 330 periodically checks portions of memory.

[0022] To detect memory errors in scrubbing mode, the controller circuit 330 reads memory 340 and checks the parity of the memory contents. In one embodiment, the controller circuit 330 reads the memory locations and compares the parity of the contents to stored parity bits. In one example of this embodiment, parity bits are stored for each word of memory. In another example, the parity bits are calculated and stored for an array or matrix of memory words. In another embodiment, the controller circuit 330 uses the results of the parity check to detect and correct single bit errors (SBEs). This detection and correction uses a Modified Hamming Code, for example. In another embodiment, the controller circuit 330 also detects multiple bit errors (MBEs) and flags the occurrence of an MBE. In another embodiment, the controller detects and corrects MBEs. This detection and correction uses Reed-Solomon codes, for example.

[0023] The amount of additional circuitry required for an IMD to detect and correct errors varies with the extent of detecting and checking done in memory scrubbing mode. In general, detecting and correcting SBEs is less expensive in terms of size, complexity and power than detecting and correcting MBEs. Because IMDs are usually battery-powered and designed to be of small size, in one example, the IMD only detects and corrects SBEs.

[0024] A memory read operation is used to detect an error and a memory write operation is used to correct an error. Much of the memory 340 of an IMD 300 may be write protected to prevent erroneous code executed by the controller circuit 330 or external device 125 from corrupting certain critical operating parameters in the IMD 300. Such critical operating parameters are stored in the write-protected region of the memory 340. However, in memory scrubbing mode the controller circuit 330 has read and write access to even the most critical locations of memory to correct errors. Error detecting and error correcting operations impact the longevity of a battery-powered IMD 300. Occasionally executing this function balances power consumption against the likelihood of errors accumulating in memory 340. When the IMD 300 is in a high-energy radiation environment, however, the likelihood of errors greatly increases and the need for memory scrubbing increases.

[0025] In one embodiment, once the controller circuit 330 enters the memory scrubbing mode, the memory scrubbing is executed continuously in controller circuit 330 and the memory scrubbing function is given higher priority than other IMD 300 functions, including those that provide therapy. This embodiment may be useful if the therapy functions are contained in RAM. In another embodiment, therapy functions are given higher priority in the controller circuit 330 than the memory scrubbing function. In an example of this embodiment, instructions contained in firmware that provide therapy are given the highest priority for execution in the controller circuit 330, and instructions to execute the memory scrubbing function use the remaining capacity of controller circuit 330. In yet another embodiment, a percentage of the capacity of the controller circuit 330 is allocated for memory scrubbing. This percentage of executing capacity is determined by designers of IMDs to balance the likelihood of errors against the amount of battery-power, and thus battery life, consumed by executing the memory scrubbing function. In yet another embodiment, this percentage of controller circuit 330 capacity allocated for memory scrubbing is programmed into the IMD using the external device.

[0026] In yet another embodiment, the percentage of capacity used for memory scrubbing is gradually reduced over time when the controller circuit 330 determines that the IMD 300 is no longer in a high-energy radiation environment. In this embodiment, the percentage is gradually decreased until the percentage capacity reaches the capacity used for error detection for normal background radiation energy levels.

[0027] To initiate memory scrubbing mode, the controller circuit 330 determines that the IMD 300 is in a high-energy radiation environment. In one embodiment, the controller circuit 330 determines that the IMD 300 is in a high-energy radiation environment by monitoring the number of errors encountered while accessing memory locations in normal operation mode. The controller circuit 330 compares the rate of memory errors to a predetermined threshold rate and enters memory scrubbing mode when the detected rate exceeds the threshold rate. The threshold rate is determined from characteristics of the device that include, among other things, the type of memory in the device and the shielding of the device. In an example of this embodiment, the threshold rate is pre-programmed into the IMD 300.

[0028] In another embodiment of determining that the IMD 300 is in a high-energy radiation environment, the controller circuit 330 is coupled to a radiation detector sensor 345 and monitors the output of the sensor 345. In an example of this embodiment, the sensor 345 outputs an electrical signal to the controller circuit 330 when a radiation level exceeds a threshold level. In another example, the sensor 345 is implemented as a radiation-detecting memory cell, or cells, designed to be more susceptible to radiation than other cells in memory 340. The controller circuit 330 then monitors such radiation-detecting memory cell or cells for an increase in a rate of memory errors in those cells to determine that the IMD 300 is in a high-energy radiation environment. In one example, the controller circuit 300 determines the IMD 300 is in a high-energy radiation environment by detecting errors in the radiation-detecting memory cells at a rate of one error per minute. In another example, the controller circuit 300 determines the IMD 300 is in a high-energy radiation environment when a predetermined number of the cells contain errors. Such radiation-detecting memory cells may be scattered or distributed throughout various physical locations in memory 340. Another example is to scatter these radiation-detecting cells as clusters of the cells throughout various physical locations in memory 340.

[0029] In another embodiment, the controller circuit 300 activates the radiation detector sensor 345 only periodically, effectively placing the sensor in an “arm” mode. This embodiment is useful in a battery-powered device to conserve battery energy used to activate the sensor 345. In one example, the controller circuit 300 is programmable to arm the sensor 345 for the duration of high-energy radiation therapy. In another example, the controller circuit 300 is programmable to arm the sensor 345 for a duration sufficient to cover multiple therapies such as durations of days or weeks.

[0030] To exit memory scrubbing mode, the controller circuit 330 determines that the IMD 300 is no longer in a high-energy radiation environment. In one embodiment, the controller circuit 330 detects that the IMD 300 is no longer in a high-energy radiation environment when the rate of memory errors falls below a predetermined threshold rate. In an example of this embodiment, the error rate is determined by monitoring a count of memory errors detected during systematic memory reads of the memory 340. This count of memory errors may be determined from only a portion of the memory being systematically read while in scrubbing mode. The exit threshold rate may be different from the initiation threshold rate. For example, the initiation rate may be one error every thirty seconds, while the exit rate may be one error every minute. This permits hysteresis in the process of initiating and exiting memory scrubbing mode.

[0031] In another embodiment, the controller circuit 330 is coupled to the radiation detector sensor 345 and the controller circuit 330 exits scrubbing mode when the sensor 345 indicates a radiation level drops below a threshold level. In yet another embodiment, the radiation sensor 345 includes a memory cell, or cells, designed to be more susceptible to radiation than other radiation cells in memory and the controller circuit 330 exits scrubbing mode when the controller circuit 330 detects that a rate of errors in the memory cell or cells has dropped below a predetermined threshold rate. Again, the predetermined exit error rate may be different from the initiation error rate to provide hysteresis to the transitioning process.

[0032] In yet another embodiment of exiting memory scrubbing mode, the controller circuit 330 is coupled to a timer circuit 350 and the controller circuit 330 is operable to exit the memory scrubbing mode after being in the memory scrubbing mode for a predetermined time duration. This time duration is set to a value longer than the time needed to deliver the high-energy radiation therapy. Examples of such a time duration include durations of minutes or hours.

[0033] In yet another embodiment of exiting memory scrubbing mode, once the controller circuit 330 determines that the device is no longer in a high-energy radiation environment, the controller circuit 330 makes a substantially immediate return to the normal radiation-level environment rate of detecting and correcting errors. In another embodiment, the controller circuit 330 gradually reduces the rate of memory scrubbing until the controller circuit 330 returns to the normal radiation-level environment rate.

[0034] The controller circuit 330 is coupled to a telemetry circuit 355. The telemetry circuit 355 communicates with an external device 125 in FIG. 1. The external device is able to communicate one or more operational parameters to the IMD 300. The parameters are then written into memory 340 to program the IMD 300. The memory 340 includes RAM and/or hardware registers. One example of setting a predetermined time duration to be in memory scrubbing mode is to program the time duration into the IMD 300 using the external device 125. The controller circuit 330 then uses the timer circuit 350 to determine when the duration is met or exceeded to exit the memory scrubbing mode.

[0035] In another embodiment of determining that the IMD 300 is in a high-energy radiation environment, the external device 125 communicates with the telemetry circuit 355 to enable a high-energy radiation memory scrubbing mode in the implantable medical device IMD 300. For example, a care giver would use the external device 125 to enable memory scrubbing mode in the IMD 300 before beginning high-energy radiation therapy. To exit the memory scrubbing mode, the external device 125 is used to disable the scrubbing mode in the IMD 300.

[0036] If the IMD patient is also a cancer patient, another embodiment of the external device 125 of FIG. 1 includes an RF transmitter 155 associated with a radiation therapy device. Such an RF transmitter 155 transmits an RF indication in the treatment room that causes IMDs or other devices to transition to a memory scrubbing mode. In one embodiment, the RF transmitter 155 communicates with the telemetry circuit 355 in FIG. 3 before radiation therapy to enable the memory scrubbing mode. In another embodiment, the RF transmitter 155 transmits continuously during the radiation therapy, and the IMDs or other devices in the treatment room remain in memory scrubbing mode while the RF transmitter is transmitting. In another embodiment of the external device 125, the external device 125 is operable to communicate with a global computer network.

[0037] FIG. 4A is a block diagram illustrating a method 400 of detecting and correcting memory errors in an IMD 300. At 410, an IMD 300 determines it is in a high-energy radiation environment. For example, a high-energy radiation environment is determined when the IMD 300 detects a number of errors that exceeds a threshold while the IMD 300 is in normal operation. In another example, the IMD 300 includes a radiation-detector sensor 345 and the sensor 345 provides an indication that the IMD 300 is in a high-energy radiation environment. In yet another example, the IMD 300 detects a number or rate of memory errors that occur in a radiation-detecting memory cell or cells. In yet another example, the IMD 300 determines it is in a high-energy radiation environment by communication with an external device 125. At 420, a memory scrubbing mode is enabled in response to the implantable medical device entering the high-energy radiation environment. At 430, a rate of detecting and correcting memory errors is increased in the IMD 300 upon the enabling of the scrubbing mode.

[0038] FIG. 4B shows a further embodiment of the method 400. At 440, the IMD 300 determines it is no longer in the high-energy radiation environment. For example, the IMD determines it is no longer in a high-energy radiation environment when the IMD 300 detects a number of errors that is below a threshold number while the device is in a memory scrubbing mode. In another example, the IMD 300 includes a radiation-detector sensor 345 and the sensor 345 provides an indication that the IMD 300 is no longer in a high-energy radiation environment. In yet another example, the IMD 300 detects that a number or rate of memory errors that occur in a radiation-detecting memory cell or cells is below a threshold number or rate. In yet another example, the IMD 300 determines it is no longer in a high-energy radiation environment by communication with an external device 125. In yet another example, the IMD 300 determines it is no longer in a high-energy radiation environment by expiration of a timed duration. At 450, the memory scrubbing mode is disabled. At 460, the IMD 300 returns to a lower rate of detecting and correcting memory errors in the device.

[0039] The accompanying drawings that form a part hereof, show by way of illustration, and not of limitation, specific embodiments in which the subject matter may be practiced. The embodiments illustrated are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be utilized and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. This Detailed Description, therefore, is not to be taken in a limiting sense, and the scope of various embodiments is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled.

[0040] Such embodiments of the inventive subject matter may be referred to herein, individually and/or collectively, by the term “invention” merely for convenience and without intending to voluntarily limit the scope of this application to any single invention or inventive concept if more than one is in fact disclosed. Thus, although specific embodiments have been illustrated and described herein, it should be appreciated that any arrangement calculated to achieve the same purpose may be substituted for the specific embodiments shown. This disclosure is intended to cover any and all adaptations, or variations, or combinations of various embodiments. Combinations of the above embodiments, and other embodiments not specifically described herein, will be apparent to those of skill in the art upon reviewing the above description.

[0041] The Abstract of the Disclosure is provided to comply with 37 C.F.R. §1.72(b), requiring an abstract that will allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment.