Combination of a medical device with a redundant controller for infusion therapy or blood treatmentand a programming device.

The invention relates to a medical apparatus for infusion therapy or blood treatment with a redundantly configured control unit according to the preamble of claim 1.

Medical devices, such as dialysis machines and infusion pumps must meet stringent safety requirements, in particular, it must be ensured that in the control unit can not occur due to failure of components or by faulty data transfer patient safety. For medical, 1985, 118-124, it is known to form redundant control unit with a microprocessor-controlled hemodialysis machine, wherein a microprocessor as a function processor to perform the control and monitoring of the dialysis machine, whereas a second microprocessor is provided as a control processor which receives the same data as the function processor and the function processor controls. It is also possible to configure function processor and control processor as diverse systems, ie to use for these microprocessors different processor types that may have been programmed with different software so that any undetected residual systematic errors, the only one of the below occur constructed differently processor systems, be recognized. The recoverable with redundantly configured controllers security level is high. However, the control units of such medical devices have an input unit, which only a few input elements, such as buttons which, to prevent incorrect operation. The program parameters are stored for the most part in the control unit. They are entered by the manufacturer and the operator can not be changed normally. The change of security-relevant data is associated with considerable risks. Any incorrect or processed or by disturbances changing data can have serious effects on the operation of the medical instrument and pose a significant risk to the patient being treated with this device. A control unit redundant design is also referred to as a two-channel system. If the control unit is designed with two channels, would have to maintain the safety standards also that device be entered or changed with the safety-related data in the control unit, also be configured with two channels. Such a two-channel programmer would be expensive and its high cost would only justify the use of such programming devices when many medical devices can be edited with a programmer. For some medical devices to such an expensive programmer would not be worthwhile.

The invention has for its object to provide a medical device that specified in the preamble of claim 1 is known, which easily can be programmed without lowering the safety standards, which on the security level of the programming device, no special requirements are needed.

This object is inventively with the features specified in the characterizing portion of claim 1.

In the medical device according to the invention, a programming device is provided which is suitable for a data exchange with the control unit, so that can be transferred from the programming device data to the control unit when the control unit does not currently performing a control process for a patient connected to the device. The programmer may have an extensive input unit in the form of a keyboard and a versatile display device in the form of a screen. While input unit and display means of the control unit are relatively simple in design and have few features and a relatively small display capacity, the programming device can be equipped with a versatile input device and display device. As programmer, for example, a conventional personal computer is. The to be transmitted to the control unit data can be pre-stored in a memory of the programming device, but they can be calculated and collected by the programmer because of programs. Finally, it is also possible to manually enter these parameters via the input unit in the programming device.

The particularity of the invention consists in that after transfer of the data from the programming device to the control unit, a process can be carried out, in which the transmitted data, which are also still stored in the programming device, both at the display means of the programming device and to that of the control unit at the same time are displayed. In comparing the user can check whether the input to the programming device or processed in the programming device data are entered correctly into the two-channel control unit and have also been stored correctly in there additionally provided application store. Any errors that occur in the data transmission channel between the programmer and controller, are detected by the data comparison of the display devices in a simple manner. Even those errors which arise during the storage within the control unit, are detected.

The invention enables the use of a conventional personal computer with monitor and keyboard as a programmer without having to implement these functional elements in each controller. This represents a considerable cost and weight savings. The user can select the programmer different procedures and modify and make the procedures before being transferred into the control unit also visible on the screen, kontrol lose and change if necessary. Here the user can enter some of the parameters while other parameters of the programmer from the entered parameters are calculated. When all required parameters to the programmer fully present, as can be done in an operating pause of the medical device, the data transfer to the control unit. Before the control unit, in which the data has been transferred, is made with the new data in operation, a comparison of the data displayed on the two display devices must by the user point by point take place, ie the user satisfy itself that the parameters are included in the programmer, have been stored correctly in the control unit. Only when this comparison test is completed, the medical device is put into operation on the patient.

During operation of the medical device to the patient's Programiergerät can remain connected to the control unit. Conveniently, however, provided that the operation on the patient, the data transmission from the programmer is interrupted to the control unit, so that the programmer can act on the current and control process in no way. The programmer, however, can participate in observing the function of the control unit, that is, it is a flow of data from the control unit to the programming device possible. In this way the user can possibly get on the programmer screen additional information about the ongoing process that can not be displayed at the very simply constructed display device of the control unit.

The application memory which receive the transmitted from the programmer to the control unit data (instruction list, parameters, constants, programs) are erasable memory, because it must be possible to delete its contents and replace it with a new content. On the other hand it must be ensured that in case of failure of the power supply to the control unit of the content of this memory is not cleared. The application memory is therefore, for example, battery-backed random access memory.

To facilitate the users the accuracy check of the transmitted data, it is expedient to carry out the control such that occurs on a button on the programmer, the continued placement of the advertisement of corresponding data to two display devices simultaneously. In this way it is ensured that always the display data to be compared to the two display devices, so that the risk that the user does not compare related data with each other is excluded. The user must check the data displayed on the display devices to match and confirm this by pressing a key. Thereby errors that may arise in the system, the transmission path or the programmer, recognized.

The invention is applicable to medical devices for infusion therapy or blood treatment applicable, which are equipped with a dual-channel controller at least. It is particularly suitable for those medical devices that perform not only program execution and monitoring functions. The data can be constants (limits) or parameters (feed rate) or an instruction list. This may be time profiles or algorithms, that include logic functions of events. This instruction set is preferably made of language elements a high level language. These language elements are in a special way for the user compared and can be implemented by the implemented in the control unit interpreters in the given application. By connecting the programming device, the applications of the medical device to be significantly expanded on the controller without additional input elements. The data can also be programs that supplement after the transfer in the application memory for the instruction set of the interpreter and to work as part of the interpreter. A modification of the interpreter is therefore without changing the read only memory possible (Bootstrapfunktion).

In the following an embodiment of the invention will be explained in more detail with reference to the drawings.

Show it:<ul><li>Fig. 1 is a schematic illustration of the control unit and the programming device,</li><li>Fig. 2 is a table of parameter sets which are transmitted from the programming device to the control unit and</li><li>Fig. 3 shows a temporal profile of a control process, which can be prepared in the programming device and its data can be transmitted to the control unit.</li></ul>

In the drawings is shown as an application example of the medical device, an infusion pump 10, which expresses the contents of a syringe 11 for supplying a liquid through a hose 12 to a patient. The infusion pump 10 comprises a (non-shown) driving motor which is controlled by the control unit thirteenth In addition to the infusion pump 10 sensors are provided whose signals are transmitted to the control unit thirteenth

The control unit 13 is constructed as a redundant dual-channel system. It contains two fold all the components, wherein the members of a pair are not necessarily the same structure, but perform the same functions. Each of the two channels includes a central processor unit (CPU) 14 and 14a, which cooperates with a working memory 15 and 15a, a read only memory 16 or 16 and an application memory 17 or 17a. The two processor units 14 and 14 are interconnected, to check their data and workflows to coincidence. If no coincidence is detected, alarm is generated.

Each channel includes an application memory 17 and 17a, respectively, which is buffered by a battery 18 or 18a. This application memory is a read-write memory. The data contained in it are obtained during a power failure by the battery 18 and 18a.

The control unit 13 comprises a (single) display device 19, wherein it is an alphanumeric display on which a data set from for example 16 numbers or letters can be displayed.

Further, an actuator 29 is provided on the control unit 13 through which it is possible to a certain parameter, for example, to manually change the infusion rate. This actuator 29 consists of a plus button and a minus button to press for the displayed on the display device 19 infusion rate can be changed up or down. The actuator 29 is reduced to a minimum of adjustment, so that the infusion operation on the controller without additional programming device can be changed, on the other hand operational errors, which could easily possible with a complex input system, are avoided.

The controller is an interface 20 provided for cooperating with the programmer 21st The programming device 21, wherein it is a personal computer, has a corresponding interface 23rd Through a transmission channel 22, for example, by a data transmission cable, the interfaces can be 23 and 20 interconnected.

The programming device 21 has in conventional manner a central processor unit (CPU) 24, a memory 25 and a read only memory 26, and further comprises a screen 27 and a manual input unit 28 in the form of a keyboard. On the keypad 28 is a dedicated button 28a is provided, whose function will be explained below.

With the help of the input unit 28 data for the operation of the infusion pump can be input into the programming device. According to FIG. 2, there is a record of the data concerning the time interval tn, the infusion rate Rn and the infusion amount Mn, where n is the index of the respective data set is. By the user, only two of the three data need to be inputted, while the third value can be calculated by the programmer.

Fig. 3 shows a possible infusion profile, in which realized over the time intervals t1 to t4 different infusion rates R1 to R4. The infusion rate R indicates the amount of liquid supplied to the patient per unit time and the infusion M is the total quantity delivered to the patient quantity of liquid. The infusion profile shown in Fig. 3 can be displayed graphically on the screen 27 so that the user can visually recognize this infusion profile and change by reprogramming before the corresponding data (parameters) are transferred to the control unit 13. The table of parameters illustrated in Fig. 2 is stored in the memory 25 of the programming device 21st

The control unit 13 contains a sensor which detects whether the drive unit 10 is in function. A data transfer from the programming unit 21 to the control unit 13 is possible only when the drive unit 10 is not in operation. Such data transfer is initiated by the user by pressing a key on the keyboard 28th The data stored in RAM 25 data is then transmitted to the application memory 17 and 17a. After completion of this data transfer, a comparison must first be performed to determine whether the data has been correctly transferred and stored. This is accomplished in that the button is pressed on the keyboard 28a of programmer 21st After initial pressure of 28 a key, the first in the table 2 parameters contained on the display device 27 of the programming device will appear as shown in FIG. 21. The command is also transmitted to the control unit 13, so that the corresponding parameter in the application store 17 and 17a is displayed on the display device 19th The user can now determine whether the ads to the display devices 27 and 19 are equal to each other. If conformity of advertisements has been found, the key 28a is pressed again, so that is advanced to the next parameter. In this way, by pressing the button 28a, a switching operation of parameters both on the display device 27 as well as on the display device 19. Pressing the button 28a is regarded as acknowledgment of the fact that agreement of both ads was found. Only when all the data has been displayed in this manner, and acknowledges, the comparison is complete.

The programming device 21 may remain connected to the control unit 13 even after the termination of data transmission. When the driving unit 10 is in operation, this is detected by the central processor units 14 and 14a and this will cause a data transfer only from the control unit 13 to the programming device 21 is possible. The programming device 21 has only one observer function in this state.

The parameter t, R and M are set forth here for reasons of ease of explanation only as examples. In addition, other data such as the maximum infusion amount per unit time, infusion rate change, instruction list can be entered, etc..