Method for error recognition in a control system of a medical treatment and/or diagnosis device

{
  "publication_number": "US9619619B2",
  "country": "US",
  "kind": "B2",
  "title": "Method for error recognition in a control system of a medical treatment and/or diagnosis device",
  "abstract": "A method for error recognition in a control system of a medical treatment and/or diagnosis device includes processing, by the control system, data in a regular operating mode and supplying, by the control system, test data of a test data record to a safety-critical component of the control system in a test mode of the control system. The safety-critical component of the control system is also checked in the test mode of the control system.",
  "claims": [
    "1. A method for error recognition and correction in a control system of a medical treatment, diagnosis, or medical treatment and diagnosis device, the medical treatment, diagnosis, or medical treatment and diagnosis device comprising a robot system, the robot system comprising a control motor, the method comprising: operating the medical treatment, diagnosis, or medical treatment and diagnosis device in a regular operating mode; processing data in the regular operating mode; instantiating a test mode of the control system, the test mode simulating real operation of the regular operating mode, the simulating comprising: supplying a safety-critical component of the control system with test data of a test data record, the test data comprising pairs of previously determined values, the pairs of previously determined values comprising an input value that is occurrable as data in actual operation of the safety-critical component and a corresponding expected output value generated by the safety-critical component operating in correct operating mode in response to the input value, the input value and expected output value comprising positioning data; checking, using a processor of the control system, the safety-critical component in the test mode, the checking comprising: calculating a test output value based on the input value, the calculating comprising: checking consistency of the input value, checking the consistency of the input value comprising carrying out a checksum verification, the input value comprising axis-specific coordinates; performing a forward transformation of the axis-specific coordinates into Cartesian coordinates; conducting a first plausibility check, the conducting of the first plausibility check comprising comparing the Cartesian coordinates with predetermined Cartesian coordinates; and performing a consistency check or a second plausibility check of the transformed Cartesian coordinates, the performing of the consistency check or the second plausibility check comprising performing a check or checksum; and comparing the test output value calculated in the test mode with the expected output value generated by the safety-critical component during the correct operating mode; determining a deviation between the test output value and the expected output value determined in the test mode and determining whether the deviation exceeds a threshold; and correcting the regular operating mode, the correcting comprising adjusting the operation of the control motor of the robot system based on the deviation when the deviation exceeds the threshold.",
    "2. The method as claimed in claim 1, wherein the data in the regular operating mode is real positioning data of the medical treatment device, the diagnosis device or the medical treatment and diagnosis device, and wherein the method further comprises: processing, by the control system, the real positioning data; transferring the real positioning data to a medical control system; and TARGET/ACTUAL comparing the processed real positioning data at the medical control system.",
    "3. The method as claimed in claim 2, wherein the safety-critical component is a processing module, in which input-side positioning data is subjected to a coordinate transformation.",
    "4. The method as claimed in claim 2, wherein the test data record is generated during the correct operating mode of the medical treatment device, the diagnosis device, or the medical treatment and diagnosis device or is provided from an external source.",
    "5. The method as claimed in claim 4, further comprising generating a warning signal, transferring the medical treatment device, the diagnosis device, or the medical treatment and diagnosis device to a safe condition or generating the warning signal and transferring the medical treatment device, the diagnosis devices, or the medical treatment and diagnosis device to the safe condition when the malfunction is detected.",
    "6. The method as claimed in claim 2, wherein the test mode is carried out recurrently.",
    "7. The method as claimed in claim 2, wherein the test data has defined erroneous values for the test mode for checking the functionality of the error recognition.",
    "8. The method as claimed in claim 2, wherein the test data record is generated during the correct operating mode of the medical treatment device, the diagnosis device, or the medical treatment and diagnosis device or is provided from an external source.",
    "9. The method as claimed in claim 2, wherein the test mode is carried out recurrently.",
    "10. The method as claimed in claim 1, wherein the test data record is generated during the correct operating mode of the medical treatment device, the diagnosis device, or the medical treatment and diagnosis device or is provided from an external source.",
    "11. The method as claimed in claim 1, wherein the test mode is carried out recurrently.",
    "12. The method as claimed in claim 11, wherein the test mode is executed by adjusting the test mode to free and currently available processing power.",
    "13. The method as claimed in claim 1, further comprising detecting a malfunction when the test output value calculated in the test mode deviates from the expected output value of the test data record.",
    "14. The method as claimed in claim 13, further comprising generating a warning signal, transferring the medical treatment device, the diagnosis device, or the medical treatment and diagnosis device to a safe condition or generating the warning signal and transferring the medical treatment device, the diagnosis device, or the medical treatment and diagnosis device to the safe condition when the malfunction is detected.",
    "15. The method as claimed in claim 1, wherein the test data has defined erroneous values for the test mode for checking the functionality of the error recognition.",
    "16. The method as claimed in claim 1, wherein the control system is a control system for an adjustment system of the medical treatment device, the diagnosis device or the medical treatment and diagnosis device.",
    "17. The method as claimed in claim 16, wherein the data in the regular operating mode is real positioning data of the adjustment system, and wherein the method further comprises: processing, by the control system, the real positioning data; transferring the real positioning data to a medical control system; and TARGET/ACTUAL comparing the processed real positioning data at the medical control system.",
    "18. The method as claimed in claim 17, further comprising detecting a malfunction when the test output value calculated in the test mode deviates from the expected output value of the test data record.",
    "19. The method as claimed in claim 1, further comprising transferring a motor of the medical treatment, diagnosis, or medical treatment and diagnosis device into a safe condition based on the comparing.",
    "20. A program-controlled medical treatment, diagnosis, or medical treatment and diagnosis device comprising: an adjustment system comprising a robot system, the robot system comprising a control motor; and a control system configured for error recognition and correction, the control system comprising a processor configured to: process data in a regular operating mode; instantiate a test mode of the control system, the test mode simulating real operation of the regular operating mode, the simulation comprising: supply of a safety-critical component of the control system with test data of a test data record, the test data comprising pairs of previously determined values, the pairs of previously determined values comprising an input value that is occurrable as data in actual operation of the safety-critical component and a corresponding expected output value generated by the safety-critical component operating in correct operating mode in response to the input value, the input value and expected output value comprising positioning data of the adjustment system; check the safety-critical component in the test mode, the check comprising: a calculation of a test output value based on the input value, the calculation of the test output value comprising: check consistency of the input value, the check of the consistency of the input value comprising carrying out a checksum verification, the input value comprising axis-specific coordinates; perform a forward transformation of the axis-specific coordinates into Cartesian coordinates; conduct a first plausibility check, the conduction of the first plausibility check comprising comparing the Cartesian coordinates with predetermined Cartesian coordinates; and perform a consistency check or a second plausibility check of the transformed Cartesian coordinates, the performance of the consistency check or the second plausibility check comprising performing a check or checksum; and a comparison of the test output value calculated in the test mode with the expected output value generated by the safety-critical component during the correct operating mode; determine a deviation between the test output value and the expected output value determined in the test mode and determine whether the deviation exceeds a threshold; and correct the regular operating mode, the correction comprising adjustment of the operation of the control motor of the robot system based on the deviation when the deviation exceeds the threshold.",
    "21. A method for error recognition and correction in a control system of a medical treatment, diagnosis, or medical treatment and diagnosis device, the medical treatment, diagnosis, or medical treatment and diagnosis device comprising a robot system, the robot system comprising a control motor, the method comprising: operating the medical treatment, diagnosis, or medical treatment and diagnosis device in a regular operating mode; processing data in the regular operating mode; instantiating a test mode of the control system, the test mode simulating real operation of the regular operating mode, the simulating comprising: supplying a safety-critical component of the control system with test data of a test data record, the test data comprising pairs of previously determined values, the pairs of previously determined values comprising an input value that is occurrable as data in actual operation of the safety-critical component and a corresponding expected output value generated by the safety-critical component operating in correct operating mode in response to the input value, the input value and expected output value comprising positioning data; checking, using a processor of the control system, the safety-critical component in the test mode, the checking comprising: calculating a test output value based on the input value, the calculating comprising: checking consistency of the input value, checking the consistency of the input value comprising carrying out a checksum verification, the input value comprising axis-specific coordinates; performing a forward transformation of the axis-specific coordinates into Cartesian coordinates; conducting a first plausibility check, the conducting of the first plausibility check comprising comparing the Cartesian coordinates with predetermined Cartesian coordinates; and performing a consistency check or a second plausibility check of the transformed Cartesian coordinates, the performing of the consistency check or the second plausibility check comprising performing a check or checksum; and comparing the test output value calculated in the test mode with the expected output value generated by the safety-critical component during the correct operating mode; determining a deviation between the test output value and the expected output value determined in the test mode and determining whether the deviation exceeds a threshold; and correcting the regular operating mode, the correcting comprising adjusting the operation of the control motor of the robot system based on the deviation when the deviation exceeds the threshold, wherein the safety-critical component comprises a processing module, and wherein the transforming is by the processing module."
  ],
  "description_excerpt": "The present patent document is a §371 nationalization of PCT Application Serial Number PCT/EP2008/067496, filed on Dec. 15, 2008, designating the United States, which is hereby incorporated by reference. This patent document also claims the benefit of DE 10 2008 003 440.1, filed Jan. 7, 2008, which is also hereby incorporated by reference.\n\nThe present embodiments relate to a method for error recognition in a control system of a medical treatment and/or diagnosis device.\n\nProgram-controlled treatment and/or diagnosis devices are used in many applications in modern diagnostics and therapeutics. Because of the sometimes complex sequence of control and movement steps, these devices may also be known as robots (e.g., as control systems are used that are largely similar to those used in industrial robot applications). The use of such robots in safety-critical applications such as, for example, medical engineering, places very high demands on system safety. It must be possible that any malfunction in the robot can be detected and that the robot can be transferred to a safe condition in the event of a malfunction of the robot. A safe condition may stop the robot, for example. For this purpose, the correct functioning of critical hardware and software components are checked during operation and any malfunction detected.\n\nTo achieve this, safety-critical components may be redundantly designed. Output values are also checked continuously against target values so that, if there is any deviation, it may be concluded that a fault has occurred in one of the safety-critical components.",
  "cpc": [
    "G16H 40/63",
    "G06F 19/3406",
    "G06Q 50/22",
    "G16H 50/20",
    "G16Z 99/00"
  ],
  "ipc": [
    "G16H 50/20",
    "G16Z 99/00"
  ],
  "assignees": [
    "KUKA Roboter GmbH",
    "Siemens AG"
  ],
  "inventors": [
    "Lorenz Bewig",
    "Till Engelmann",
    "Andreas Hagenauer",
    "Torsten Hasenzahl",
    "Dirk Jacob",
    "Matthias Mühlhäusser",
    "Tobias Ortmaier",
    "Dietmar Tscharnuter"
  ],
  "filing_date": "2008-12-15",
  "publication_date": "2017-04-11",
  "grant_date": "2017-04-11",
  "priority_date": "2008-01-07",
  "application_number": "US-81150808-A",
  "family_id": "40566166",
  "cited_by_count": 4,
  "citations": [
    "US4831549A",
    "JPH0371983A",
    "KR950003978A",
    "US5862502A",
    "JPH08141950A",
    "EP1113760B1",
    "US6033415A",
    "US6577918B1",
    "US6614038B1",
    "DE19907771A1",
    "US6519860B1",
    "CN1471626A",
    "US6937943B2",
    "US20040267404A1",
    "US20030144809A1",
    "US7114157B2",
    "US20090069936A1",
    "US20060074527A1",
    "US20070050759A1",
    "CN1892662A",
    "US7747406B2",
    "US20070195922A1",
    "US20070078565A1",
    "US20100145521A1",
    "US7930065B2",
    "US8065060B2",
    "US20100299101A1",
    "US20110022407A1"
  ]
}