EP2034463A2 - Procédé et dispositif de transmission sans fil de signaux - Google Patents

Procédé et dispositif de transmission sans fil de signaux Download PDF

Info

Publication number
EP2034463A2
EP2034463A2 EP08104947A EP08104947A EP2034463A2 EP 2034463 A2 EP2034463 A2 EP 2034463A2 EP 08104947 A EP08104947 A EP 08104947A EP 08104947 A EP08104947 A EP 08104947A EP 2034463 A2 EP2034463 A2 EP 2034463A2
Authority
EP
European Patent Office
Prior art keywords
signals
safety
base part
control
control unit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP08104947A
Other languages
German (de)
English (en)
Other versions
EP2034463A3 (fr
Inventor
Jürgen Holstegge
Robert Kagermeier
Steffen Schröter
Dietmar Sierk
Eike Dr. Rietzel
Andres Sommer
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Siemens AG
Original Assignee
Siemens AG
Siemens Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Siemens AG, Siemens Corp filed Critical Siemens AG
Publication of EP2034463A2 publication Critical patent/EP2034463A2/fr
Publication of EP2034463A3 publication Critical patent/EP2034463A3/fr
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G08—SIGNALLING
    • G08C—TRANSMISSION SYSTEMS FOR MEASURED VALUES, CONTROL OR SIMILAR SIGNALS
    • G08C17/00—Arrangements for transmitting signals characterised by the use of a wireless electrical link
    • G08C17/02—Arrangements for transmitting signals characterised by the use of a wireless electrical link using a radio link
    • G—PHYSICS
    • G08—SIGNALLING
    • G08C—TRANSMISSION SYSTEMS FOR MEASURED VALUES, CONTROL OR SIMILAR SIGNALS
    • G08C25/00—Arrangements for preventing or correcting errors; Monitoring arrangements
    • G—PHYSICS
    • G08—SIGNALLING
    • G08C—TRANSMISSION SYSTEMS FOR MEASURED VALUES, CONTROL OR SIMILAR SIGNALS
    • G08C2201/00—Transmission systems of control signals via wireless link
    • G08C2201/60—Security, fault tolerance
    • G08C2201/63—Redundant transmissions

Definitions

  • the invention relates to a method and a device for the wireless transmission of signals between a mobile operating part and a base part of a safety-critical device, in particular a medical treatment device.
  • Such a method and such a device are in the DE 10 2004 040 959 A1 described.
  • a malfunction due to transmission errors in the wirelessly transmitted signals must be ruled out in the case of wireless, remote-controlled operation of the device.
  • This so-called “first fault safety” is performed according to the DE 10 2004 040 059 A1 achieved by duplicating a signal to be transmitted, and passing each copy of the duplicated input signal to a separate independent software path and transmitting it wirelessly to a base part. In the base part, the two copies are then tested for consistency. If the signals match, a corresponding output signal is issued as a control signal for the device.
  • Such a method requires comparatively high computing power and also leads to a comparatively high degree of complexity, which must be taken into account in the event of software changes or additions.
  • the invention is therefore based on the object to enable a simplified wireless signal transmission without security losses compared to the known methods.
  • the object is achieved according to the invention by a method having the features of claim 1 and by a device having the features of claim 14. Thereafter, it is provided that the signals to be transmitted from a mobile control unit to a fixed base part in safety-related control signals and uncritical communication signals be divided, and that only the safety-related control signals for fail-safety, namely transmission or initial fail-safety, to be checked. In contrast, the uncritical communication signals are transmitted without safety testing and thus separated from the control signals between the base part and the control unit.
  • the logical separation is achieved, for example, by specifying the transmission in separate areas of a common transmission protocol.
  • the high outlay for fail-safe transmission is carried out only with regard to those signals which are actually safety-critical.
  • the strict separation of these two signal types also ensures that there is no mixing between the signal types. It is thus ensured that all safety-related control signals are actually transmitted fail-safe. Due to the clear separation of the signal types, it is also possible to easily change and maintain the underlying software, for example operating software.
  • the separation of these different types of signal avoids the mixing of safety-related and non-safety-critical functions. This leads to the easy handling of the non-safety-critical functions.
  • These functions are, for example, the menu guidance or display options on the control panel. Also can a keypad through this logical Separation of the signal types readily new devices are made known, which are then controlled, for example, on their own menus on the control panel.
  • control part hereinafter also referred to as a handset, is generally understood an input device which serves as a so-called user interface (user interface), via which the respective operator transmits control signals to the device or signals about the state of the device gets displayed.
  • This control panel can be configured as a control panel with switching and control elements and with an optical display element or as a portable handset.
  • safety-relevant control signals are preferably understood to be signals which influence an adjustment movement and / or radiation parameters of the device.
  • General are safety-relevant such signals that affect a function of the device, which can lead to a potential danger in particular of a patient or the basic operational readiness of the device. For example, it must be ensured that the control device does not move the device to a position at which, for example, the patient is already located or where another object is located. Certain boundary conditions for speed, acceleration, etc. of the adjustment movements also apply.
  • Further safety-relevant functions, in particular in the case of a medical device are the parameters summarized as irradiation parameters, by means of which the treatment of the patient is controlled. Treatment means any intervention in the patient's body with the aid of the medical device.
  • the medical device is, for example, a diagnostic device which irradiates the patient for diagnostic purposes, such as an X-ray device, a computed tomography device, a magnetic resonance device, etc.
  • the medical device is, for example, a therapy device in which a direct tumor treatment takes place via particle irradiation.
  • irradiation parameters are understood as meaning, for example, parameters via which the irradiation intensity, the irradiation duration, the type of radiation, the focus of the radiation, the distance of the beam source from the patient, etc. are set.
  • the safety-relevant signals are - since they are control signals for the device - preferably transmitted only unidirectional from the control panel to the base part.
  • the check for failure safety is thus preferably only in the direction of the control panel to the base part.
  • the security-relevant signals are transmitted bidirectionally and checked.
  • the uncritical communication signals are preferably optional graphic signals or selection signals.
  • Graphic signals are understood to mean signals of this kind, via which display settings on the control unit or also on the medical device are changed. Such display settings are, for example, special user interfaces of a control menu, the activation of signal lights, etc.
  • Selection signals are understood as signals via which non-safety-relevant device functions are selected and selected. Such device functions are, for example, functions with regard to the image processing, such as zoom factor, sharpness settings, selection of image sections, choice of data displayed, etc.
  • the control of the individual display monitors, the selection of the respective menu, the selection of a specific calculation algorithm, etc. are in this case device functions, which have no direct influence on the patient and thus represent a hazard.
  • the safety-related control signals are encoded according to an expedient embodiment in the handset by means of a check code and decoded again in the base part.
  • a so-called test information or a test code is added to the signals, by means of which the fail-safe transmission of the respective individual signal can be checked.
  • Each individual signal is provided with such special unique test information.
  • a so-called CRC Cyclic Redundancy Code
  • a 32-bit CRC assigned.
  • control signals are expediently transmitted redundantly, that is to say a copy is made of the respective individual signal to be transmitted, transmitted and then checked again for conformity with the original transmitted in parallel at the base part, as described in US Pat DE 10 2004 040 059 A1 is provided.
  • a control unit is provided in the control unit and / or in the base part, preferably in both parts, with the aid of which the distinction is made in safety-relevant control signals and uncritical communication signals.
  • the signals are processed separately on the one hand on the side of the control panel and on the other hand on the side of the base part and prepared for the transmission.
  • safety-related control signals and uncritical communication signals are expediently realized hardware-technically for safety-related considerations, in particular by the safety-relevant control signals being received by a connection at the respective control unit via a defined pin assignment (pin assignment). Signals present at these defined connection contacts are automatically identified as safety-relevant control signals.
  • the individual operating elements for the exercise of the control signals are therefore connected to a respective input pin of the control unit assigned to them.
  • each control element is associated with at least one of the input pins.
  • the security-critical communication signals are preferably transmitted via a data bus, that is to say a single data line for different signals.
  • the control unit comprises a security module for processing the safety-critical control signals and a further module for processing the uncritical communication signals.
  • a security module for processing the safety-critical control signals
  • a further module for processing the uncritical communication signals.
  • UI controller for the so-called user interface, via which the functionality of the user interface, so the mobile control panel, can be set, programmed and changed.
  • Such settings relate, for example, to the graphic settings or also the settings as to which type of devices can be controlled from the control panel, etc.
  • all safety-critical functions are not influenced by this UI controller.
  • This designed as a UI controller further module is also referred to as a control module, and generally takes over the control of the functionality of the handset.
  • a control unit with a security module are provided both in the base part and in the control unit, wherein the two security modules control the transmission of the signals. That is, via the security modules, the exchange and the communication takes place both with regard to the safety-critical control signals and with regard to the non-critical communication signals.
  • the coding takes place and in the security module of the base part, the decoding of the security-relevant control signals.
  • the actual activation of the device takes place via the base part.
  • this is the safety-critical communication with a system control of the device via the security module.
  • the safety module thus transmits the safety-critical control signals, whereas the exchange of communication signals with the device takes place via the operating module.
  • the safety-critical control signals via a 1: 1 wiring between the security module of the base part and the system control done, whereas the communication signals are preferably exchanged via a data bus.
  • FIG. 1 shows in a greatly simplified block diagram representation of a device which is designed for wireless transmission of signals between a mobile control unit and a base part for controlling a safety-critical device, in particular a medical treatment device.
  • the device accordingly comprises a handset 2, a base part 4 and a system controller 6. These three components form components of a safety-relevant device not shown here.
  • the handset 2 is formed as an independent and freely movable, provided with its own housing part, which is arranged, for example, portable or arbitrarily movable in space.
  • the base part 4 is preferably firmly connected to a main component of the device, in which the system control is integrated.
  • the safety-critical device is in particular a medical treatment device.
  • the handset 2 and the base part 4 are designed for wireless communication with each other and for this purpose have a corresponding wireless communication interface 8, which is constructed, for example, according to the Bluetooth standard.
  • the mobile part 2 has a first control unit 10A, which comprises a first security module 12A and a second, further module, which is referred to below as a graphics controller 14A.
  • the base part 4 comprises a second control unit 10B with a second security module 12B and a second further module, which is referred to below as the adjustment module 14B.
  • the operating module 14B may also be referred to as a UI controller (user interface controller).
  • the handset 2 further comprises a display 16, for example a screen.
  • a display 16 for example a screen.
  • controls 18A, B are provided, via which an operator can make inputs over which the medical device is controlled.
  • the display 16 also provides the operator with information, in particular about the state of the device, and different menus are displayed for selection.
  • the elements 18A, B serve exclusively for the input of uncritical communication signals K, whereas the operating elements 18B serve exclusively for the input of safety-related control signals S.
  • the first control elements 18A can be of any desired nature and, for example, also a touch screen or other software-supported control elements are provided
  • the second control elements 18B are directly connected to the first security module 12A, ie via a direct wiring. Illustrated by way of example only, individual contact pins 20 are shown here as connection contacts in the figure. Thus, there is a 1: 1 pin assignment between a respective second operating element 18B and a contact pin 20 of the first control unit 10A.
  • the control signals S are transmitted from the second operating elements 18B to a first computer unit (microprocessor) 22A of the first security module 12A.
  • the communication signals K are transmitted from the first operating element 18A to the computer unit 22.
  • the communication signals K are transmitted from the first operating elements 18A via the graphics controller 14A to the computer unit 22.
  • the safety-related control signals S are processed in the computer unit 22, in particular in the manner as described in the DE 10 2004 040 059 A1 is described.
  • this duplicates a respective Control signal S. That is, each incoming control signal S is duplicated so that it is redundant. It is possible here to invert a copy of the duplicated control signal S. Subsequently, the original and the copy of the respective individual control signal S with a check information, namely a so-called CRC (Cyclic Redundancy Code) provided and forwarded in this form to the communication interface 8 for processing and transmission.
  • CRC Cyclic Redundancy Code
  • the signals K, S are received on the side of the base part 4 of the local communication interface 8 and forwarded to a local located in the second security module 12B second computer unit 22B for further processing.
  • This computer unit 22B distinguishes between the communication signals K and the control signals S. While the communication signals K are forwarded substantially without any special processing, the decoding of the security-relevant control signals S takes place in the computer unit 22B. In this case, the check information is initially checked, that is to say whether the arrived data signals are plausible. Subsequently, the redundantly transmitted information of the respective individual control signal S is optionally compared with each other for consistency after being inversed. If a fail-safe transmission is identified here, the control signals S are transmitted to a signal output module 26, via which the control signals S are then forwarded to the system controller 6 of the medical device.
  • the system controller 6 is also connected to the second control module 10B via corresponding contact pins 20 by means of a 1: 1 pin assignment with respect to the control signals S. connected to a wiring.
  • the communication signals K are transmitted from the computer unit 22B to the operating module 14B in which they are then processed and forwarded to the system controller 6.
  • the data exchange of the communication signals K between the operating module 14B and the system controller 6 is preferably carried out via a bus module 28.
  • a data bus for example the CAN bus, is provided here.
  • the management and control of the individual functions of the handset 2 is deposited. That is, the functionality of the handset 2 is determined via this operating module 14B.
  • functionality is understood to mean which technical devices can be activated by the mobile part 2 or also which functions of a single technical device can be controlled by the mobile part 2.
  • several monitors can be provided on the medical device.
  • the functionality of the mobile part 2 is now set up via the operating module 14B insofar as, for example, the switching between the different monitors is permitted.
  • Not included in the operating module 14B is the influencing of the functionality of the safety-critical second operating elements 18B, since the safety-critical control signals S are output via them.
  • the adjustment module 14B is designed to configure the mobile part 2.
  • a download functionality is provided so that configuration data, for example, from the system controller 6 via the operating module 14B as communication signals K to the graphics controller 14A are transmitted.
  • configuration data are, for example, bitmaps, that is graphic data for the user interface, or else texts, etc.
  • the communication level means all components which are responsible for the functionality with regard to the communication signals K, that is to say for the graphical representation (graphic signals, display settings) or also for so-called selection signals for controlling non-safety-relevant device functions. Overall, this allows easy maintenance and treatment of this level of communication. At the same time, the safety-critical transmission of the control signals S remains unaffected.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Magnetic Resonance Imaging Apparatus (AREA)
  • Selective Calling Equipment (AREA)
  • Measuring And Recording Apparatus For Diagnosis (AREA)
EP08104947.0A 2007-09-04 2008-08-01 Procédé et dispositif de transmission sans fil de signaux Withdrawn EP2034463A3 (fr)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
DE102007041902A DE102007041902A1 (de) 2007-09-04 2007-09-04 Verfahren sowie Vorrichtung zur drahtlosen Übertragung von Signalen

Publications (2)

Publication Number Publication Date
EP2034463A2 true EP2034463A2 (fr) 2009-03-11
EP2034463A3 EP2034463A3 (fr) 2013-04-10

Family

ID=40149605

Family Applications (1)

Application Number Title Priority Date Filing Date
EP08104947.0A Withdrawn EP2034463A3 (fr) 2007-09-04 2008-08-01 Procédé et dispositif de transmission sans fil de signaux

Country Status (3)

Country Link
US (1) US8391782B2 (fr)
EP (1) EP2034463A3 (fr)
DE (1) DE102007041902A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3352030A1 (fr) * 2017-01-24 2018-07-25 Siemens Healthcare GmbH Unité d'extension portative pour l'utilisation d'un appareil médico-technique et procédé de fonctionnement d'un appareil médico-technique
EP3486915A1 (fr) * 2017-11-17 2019-05-22 Siemens Healthcare GmbH Procédé de commande de fonctionnement d'un dispositif technique médicale, appareil de commande, système de commande et dispositif technique médicale

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8453160B2 (en) * 2010-03-11 2013-05-28 Honeywell International Inc. Methods and systems for authorizing an effector command in an integrated modular environment
US11239919B2 (en) * 2018-12-20 2022-02-01 Acacia Communications, Inc. Side channel communication for an optical coherent transceiver

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102004040059A1 (de) 2004-08-18 2006-02-23 Siemens Ag Verfahren und Vorrichtung zur sicherheitsgerichteten drahtlosen Signalübertragung
DE102004040959A1 (de) 2004-08-24 2006-04-13 Erbe Elektromedizin Gmbh Chirurgisches Instrument

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5607458A (en) * 1995-07-13 1997-03-04 Pacesetter, Inc. Safety optimization in microprocessor controlled implantable devices
EP1107079A2 (fr) * 1999-11-30 2001-06-13 Siemens Aktiengesellschaft Apparéil, méthode et système pour la communication d'informations critiques
GB2363944B (en) * 2000-06-21 2004-05-12 Ericsson Telefon Ab L M Telecommunications systems
US7073083B2 (en) * 2001-07-18 2006-07-04 Thomas Licensing Method and system for providing emergency shutdown of a malfunctioning device
DE10317131A1 (de) * 2003-04-14 2004-10-28 Siemens Ag Verfahren zur Datenübertragung von sicherheitsrelevanten Informationen

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102004040059A1 (de) 2004-08-18 2006-02-23 Siemens Ag Verfahren und Vorrichtung zur sicherheitsgerichteten drahtlosen Signalübertragung
DE102004040959A1 (de) 2004-08-24 2006-04-13 Erbe Elektromedizin Gmbh Chirurgisches Instrument

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3352030A1 (fr) * 2017-01-24 2018-07-25 Siemens Healthcare GmbH Unité d'extension portative pour l'utilisation d'un appareil médico-technique et procédé de fonctionnement d'un appareil médico-technique
US10993695B2 (en) 2017-01-24 2021-05-04 Siemens Healthcare Gmbh Portable expansion unit for operating a medical device, and method for operating a medical device
EP3486915A1 (fr) * 2017-11-17 2019-05-22 Siemens Healthcare GmbH Procédé de commande de fonctionnement d'un dispositif technique médicale, appareil de commande, système de commande et dispositif technique médicale
US10966680B2 (en) 2017-11-17 2021-04-06 Siemens Healthcare Gmbh Method for controlling the operation of a medical technology device, operator device, operating system and medical technology device

Also Published As

Publication number Publication date
US20090062937A1 (en) 2009-03-05
US8391782B2 (en) 2013-03-05
EP2034463A3 (fr) 2013-04-10
DE102007041902A1 (de) 2009-03-12

Similar Documents

Publication Publication Date Title
EP0384155B1 (fr) Combination d'un dispositif médical avec contrôleur superflu pour perfusion thérapeutique ou traitement de sang et d'un dispositif de programmation
EP2422271B1 (fr) Procédé et dispositif d'établissement d'un programme utilisateur pour une commande de sécurité
EP2363770B1 (fr) Dispositif de sécurité doté d'un contrôleur configurable
EP2098926B1 (fr) Procédé et dispositif adaptés à la programmation et/ou la configuration d'un contrôleur de sécurité
EP1362269A2 (fr) Procede et dispositif de programmation d'une commande de securite
EP3712770B1 (fr) Unité de surveillance pour interfaces graphiques utilisateur relatives à la sécurité
WO2020087099A1 (fr) Procédé servant à faire fonctionner un système de commande de machine et système de commande de machine correspondant
EP4235323A2 (fr) Procédé et appareil de validation automatique de fonctions de sécurité sur un système de sécurité modulaire
EP2246756B1 (fr) Procédé et appareil de commande destinés à commander un composant d'automatisation industriel lié à la sécurité
EP2098924A1 (fr) Procédé et dispositif adaptés à la programmation et/ou la configuration d'un contrôleur de sécurité
DE102015015963B4 (de) Formgebungsanlage sowie Verfahren zu deren Betreiben
EP2034463A2 (fr) Procédé et dispositif de transmission sans fil de signaux
EP2098928A1 (fr) Procédé et dispositif adaptés à la programmation et/ou la configuration d'un contrôleur de sécurité
AT521871A1 (de) Verfahren zum Betreiben eines Maschinensteuerungssystems sowie Maschinensteuerungssystem
DE102004020994B4 (de) Verfahren und Vorrichtung zum computergestützten Konstruieren einer sicherheitsgerichteten elektrischen Schaltung
EP3082002A1 (fr) Commande de securite et procede de commande d'une installation automatisee
WO2009021901A1 (fr) Procédé pour déclencher des actions d'une machine par des éléments d'entrée fiables
DE19834863A1 (de) Verfahren zur sicheren Datenübertragung zwischen einer numerischen Steuerung und einem räumlich getrennten Gerät
DE102017216677A1 (de) Verfahren und Anordnung zum Bereitstellen eines Zugriffs auf mindestens ein Feldgerät einer technischen Anlage
WO2025007174A2 (fr) Système d'entrée à écran tactile et procédé d'entrée
EP4321949A1 (fr) Dispositif de commande modulaire
EP1672446A2 (fr) Module d'entrée/sortie sécurisé pour un controleur
DE102005007477B4 (de) Programmierbare Steuerung zur Maschinen-und/oder Anlagenautomatisierung mit Standard-Steuerungs- und Sicherheitsfunktionen und Kommunikation mit einer Sicherheits-EA sowie Verfahren zum Betrieb der programmierbaren Steuerung
EP2246761B1 (fr) Procédé de modifications assurées des paramètres d'un composant d'automatisation industriel protégé contre les erreurs
EP4152108A1 (fr) Dispositif de sécurité et procédé de fonctionnement d'un dispositif de sécurité

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA MK RS

PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: SIEMENS AKTIENGESELLSCHAFT

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA MK RS

RIC1 Information provided on ipc code assigned before grant

Ipc: G08C 25/00 20060101ALI20130304BHEP

Ipc: G08C 17/02 20060101AFI20130304BHEP

AKY No designation fees paid
REG Reference to a national code

Ref country code: DE

Ref legal event code: R108

REG Reference to a national code

Ref country code: DE

Ref legal event code: R108

Effective date: 20131218

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN

18D Application deemed to be withdrawn

Effective date: 20131011