CROSS REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of priority under 35 U.S.C. § 119 of German Application 10 2020 001 561.1, filed Mar. 10, 2020, the entire contents of which are incorporated herein by reference.

TECHNICAL FIELD

The present invention pertains to a medical device arrangement with a test module for testing the processing of data sets to be processed during the operation of the medical device arrangement. The present invention pertains, furthermore, to a process for testing the processing of data sets to be processed during the operation of a medical device arrangement.

TECHNICAL BACKGROUND

It is known that for testing the ability of components of an electronic device arrangement to function, such a component is actively polled for status information and/or status information is passively obtained from such a component during the operation. A failure of this component shall be able to be detected and corresponding problems shall be able to be corrected hereby as rapidly as possible. This is especially advantageous for safety-relevant applications, in which a failure or a malfunction of a component has an effect, for example, on the health of the user of the device arrangement.

In order to increase the reliability of such device arrangements or device systems, for example, 1oo2, 2oo2 or 2oo3 architectures are used in practice. Here, “oo” means, spelled out, “out of.” Thus, two independent hardware channels, which can come to the same result independently in themselves, are embodied in the 1oo2 architecture. As a result, the system is still able to function in case of a failure of one hardware channel. It is required in the 2oo2 architecture that both hardware channels come to a consistent result in order to achieve a result tested hereby. In a 2oo3 architecture, there are three independent hardware channels, two of which must show a consistent result in order to come to a result tested hereby.

SUMMARY

An object of the present invention is to provide an improved testing of the processing of data sets to be processed, in particular an especially reliable testing of the processing of these data sets during the operation of a medical device arrangement.

A medical device arrangement with a test module for testing the processing of data sets to be processed during the operation of the medical device arrangement, having a data interface, a number of analysis modules and the test module, is proposed according to the present invention for accomplishing this object.

The data interface is configured to receive a medical data set to be processed. The data interface may be according to the present invention an interface of a cable-based or wireless connection. The configuration of such a data interface is known for a plurality of possible connections and will not be explained in detail below.

The number of analysis modules is configured to process the medical data set, wherein each analysis module forms a processing instance for the medical data set or for the medical data set already preprocessed by at least one analysis module, and wherein the medical data set is outputted as an output data set after the processing by the number of analysis modules. The analysis modules may be components of a common analysis, which are separated in space, or at least partially different software blocks of a single component for providing this joint analysis.

The test module is configured to output a test data set to at least one analysis module, especially to one analysis module of the number of analysis modules during the operation of the medical device arrangement such that this analysis module processes the test data set in the same manner as it does the medical data set. The test module is configured, furthermore, to compare, after a processing of the test data set by the analysis module or by a plurality of consecutive analysis modules, a correspondingly outputted, processed test data set with a reference result associated with the test data set and to determine a test result based on this comparison. Finally, the test module is further configured to output corresponding warning information in case of an insufficient agreement between the processed test data set and the associated reference result. The output of the warning function may take place, for example, internally to an additional module of the medical device arrangement and/or to an external module outside the medical device arrangement and/or to a user. The associated reference result is typically the result that the analysis modules would output without the presence of a malfunction during the processing of the test data set.

It was found within the framework of the present invention that the operability of the analysis modules used can be achieved during an operation of the medical device arrangement in an especially simple manner by the processing of data by the analysis modules being reconstructed on the basis of test data with a corresponding, associated reference result. A test module is provided according to the present invention in the medical device arrangement for introducing these test data and for comparison of the test data with the associated reference result.

The use of test data sets makes it advantageously possible to test different sources of fault within the number of analysis modules. Thus, even especially complex and/or fault-prone scenarios can be depicted for medical data as a test on the basis of the test data set. Furthermore, especially many different scenarios for medical data can be depicted as a test by the use of test data sets. This makes possible an especially reliable testing of the operability of the medical device arrangement during the operation.

The medical device arrangement according to the present invention makes it advantageously possible to detect a malfunction, which has not been present when the arrangement was made available, for example, in the presence of corrupted hardware in the form of bit flips, which may have been caused by cosmic radiation or by an interruption of the power supply. The medical device arrangement according to the present invention is therefore especially advantageous compared to prior-art test processes, in which different test scenarios outside a regular operation are tested prior to the medical device arrangement being made available.

Thus, the testing according to the present invention is especially advantageous in the case of the occurrence of random faults, which do not occur in a reproducible manner. While systematic, reproducible faults are typically detected already prior to the delivery of the medical device arrangement to the end user, random faults may also occur when a product was designed and tested in an incorrect manner. Such random faults, which may occur during the operation, are detected by the medical device arrangement according to the present invention after a certain time, so that their presence will not remain undetected for a needlessly long time. The medical device arrangement according to the present invention makes it possible in this sense to achieve in an especially advantageous manner a so-called “single fault safety,” as it is described in IEC 60601-1.

The different components of the medical device arrangement according to the present invention may be contained in a single, common housing or in a plurality of housings, partially separated from one another.

The number of analysis components (analysis modules) and the test module are preferably parts of a processing by a common processor or by a plurality of processors, which parts are separated in the test module at the software level. The one or more processors may be associated with memory or a memory unit.

The criteria as to the point starting from which an agreement of parts of two data sets leads in a direct comparison to a sufficient agreement in the sense of the present invention are preferably stored in a memory of the test module and are applied by the test module to determine the test result.

The medical device arrangement is an arrangement of data-processing components, which has an information exchange with at least one data-logging medical device. The medical device arrangement may thus be arranged directly at or in the medical device or form a component separated in space from the at least one data-logging medical device or form a plurality of components separated in space from the at least one data-logging medical device.

Preferred embodiments of the medical device arrangement according to the present invention will be described below.

In a preferred embodiment, the test module is further configured to provide corresponding test information in case of a sufficient agreement between the processed test data set and the associated reference result. In this embodiment, corresponding information pertaining to the testing carried out and the corresponding test result are stored in case of a sufficient agreement and in case of an insufficient agreement. As a result, a user of the medical device arrangement is able to reconstruct, even after a certain time period, which analysis modules were tested and in what manner during the certain time period in question.

In a preferred embodiment, the test module has, furthermore, a memory and is configured to obtain from the memory the reference result associated with the test data set as a test data pair from a predefined plurality of test data pairs. The data sets that belong together can be accessed in an especially simple manner in this embodiment. The test data set and the reference result preferably have a common identification, which ensures during an electronic analysis that the association of the test data set and the reference data set is always possible.

In an especially preferred embodiment, the test data sets from the predefined plurality of test data pairs are predefined such that the largest possible number of different result states of the respective analysis module are produced by the test data set.

In an especially advantageous embodiment, the assignment from the processed test data set to the associated reference result takes place via a common test number and/or test digit. Such a test number and/or test digit can ensure that it is still recognizable even after a performed processing and/or after a certain further run time of the medical device arrangement that the processed data set was originally the test data set associated with the reference result. This is especially advantageous if a plurality of test data sets are processed simultaneously. As an alternative or in addition, it can be recognized on the basis of the test number and/or the test digit whether an incorrect change of the test data set or of the associated reference result has taken place. Furthermore, the test number of a test data set can be used to test a processing of a test data set on the basis of a test sum of test numbers, for example, of the test data set and the associated reference result or of a plurality of test data sets. A comparison of a result calculated for the test data set with the reference result can also be carried out on the basis of test numbers and/or test digits.

In another advantageous embodiment, a respective test sum is associated with the respective test data set. The respective analysis module or the test module is configured to test prior to a processing of the corresponding test data set based on the test sum whether the test data set to be processed, which is provided by the test module, is also the originally stored test data set. It can be avoided hereby that a corrupted test data set leads to an incorrect output of warning information, because faults within the test data set can be detected in time. The precise association of a suitable test sum is known to the person skilled in the art, so that concrete processes for determining a test sum will not be explained below. The association of the processed test data set with the reference result may advantageously also be carried out on the basis of the test sum of the test data set.

In an especially advantageous embodiment, a respective analysis module is configured to provide for the processing of a test data set to be processed a processing instance which is parallel to the processing instance for the medical data set and which processes the test data set in the same manner as the respective analysis module processes the medical data set. The processing of the medical data during the operation of the medical device arrangement is not interrupted or substantially interfered with by the testing by means of the test data set in this embodiment. The parallel processing instance is, for example, a copy of a software block, which forms the original processing instance of the respective analysis module. As an alternative, the parallel processing instance may be an instance of a programmed object class. The provision of a parallel processing instance at the software level advantageously reduces manufacturing costs compared to a parallel processing instance that is provided at the hardware level as a fixed, i.e., static processing instance. In a preferred variant, there is a respective parallel processing instance only for an analysis module or for individual analysis modules of the plurality of analysis modules. Costs can be reduced hereby compared to the provision of parallel processing instances for all analysis modules.

In a preferred variant of the above embodiment, the test module is further configured to output the test data set to be processed to both the processing instance and the parallel processing instance and to determine a first test result for the processing instance and a second test result for the parallel processing instance. By testing both processing instances in this variant, it is possible to check whether the processing instance used up to this point is operating correctly. Testing the parallel processing instance shows only whether the copy of the processing instance is operating, so that any possible faults during the copying of the processing instance would not make it conclusively possible to make a reliable statement on the operability of the original processing instance. Furthermore, the testing of the processing instance used up to that point makes it possible to validate data used up to that point. In an alternative embodiment, different test data sets to be processed are outputted to the processing instance and to the parallel processing instance, and a first test result is determined for the first processing instance and a second test result is determined for the parallel processing instance.

In another advantageous embodiment, the parallel processing instance is used as the processing instance to be used for the medical data in case of a sufficient agreement between the processed test data set and the associated reference result. It is ensured in this embodiment that the processing instance used after the testing has led to a sufficient agreement between the processed test data set and the associated reference result. The processing instance originally used for the processing of the medical data set is preferably deleted.

In another embodiment, a parallel processing graph is provided by a plurality of analysis modules of the number of analysis modules, and the test data set is processed in this parallel processing graph in the same manner in which the plurality of analysis modules as a chain of processing instances process the medical data set. As was described in the above embodiments, a test data set is also fed to the original processing graph in one variant besides to the parallel processing graph, and a respective test result is determined for both graphs. And the original processing graph is discarded in case of an agreement detected on the parallel processing graph. In addition, the data sets calculated up to that point can be considered to be validated.

In an especially preferred embodiment of the medical device arrangement according to the present invention, the test module is configured to determine the analysis module to be tested, a test time to be used for the testing and/or the test data set to be outputted at least partially via a randomized process. It is ensured by such a randomized determination that parts of the analysis module or subsets of possible medical data sets are not taken systematically into account by the test module during the testing. Furthermore, it is ensured that a large number of different scenarios can be modulated on the basis of the test data sets used by the test module. As a result, it is possible randomly to detect even difficult-to-detect faults within the number of analysis modules, without these faults being relevant for the processing of usual, medical data. It can thus be ensured that a fault-free processing is provided by the number of analysis modules even for medical data sets having an unusual content.

In one embodiment, which is an alternative or addition to the previous embodiment, the medical device arrangement has, furthermore, a security module, which is configured to output a start signal in case of a faulty behavior of the number of analysis modules, which start signal indicates the presence of the faulty behavior, and wherein the test module is further configured to receive the start signal and to at least partially determine, depending on the start signal, the analysis module to be tested, a test time to be used for the testing and/or the test data set to be outputted. For example, the security module may send an automated polling of status signals and receive in response corresponding status signals. The absence of such a receipt of status signals can be detected as a faulty behavior and lead to the output of the start signal. Furthermore, a faulty behavior can be detected if the output data set or an individual processed data set can be associated with a data set type from a predefined group of obviously incorrect data set types. This predefined group of obviously incorrect data set types may have, for example, one of the following elements: A stream of identical data lasting over the predefined time period, data sets of non-stored test numbers and/or test digits, data sets with empty data elements, data set sequences with a data rate below a predefined rate threshold value, data sets with a signal-to-noise ratio below a predefined ratio threshold value and/or a data set with unknown data structure. In another variant, a faulty behavior is detected by a separate sensor, e.g., an acceleration sensor and/or an optical sensor of the medical device arrangement.

In another embodiment, the medical device arrangement has a sensor unit, which is configured to determine medical data and to determine the medical data set based on the medical data and to output it via the data interface to the number of analysis modules. The sensor unit typically records medical data concerning a patient by a corresponding sensor element in this embodiment. The assessment of whether a sufficient agreement is present between the processed data set and the associated reference result typically depends on the type of the sensor elements used within the sensor unit. In an advantageous variant of this embodiment, the absence of warning information leads to a recalibration of the sensor unit recording the medical data.

In an especially preferred embodiment, the test module and/or the respective analysis module are configured to provide a predefined temporary fault state of the analysis module in order to be able to detect a malfunction of the test module. A faulty behavior of the test module is detected in this embodiment by testing whether the fault of an analysis module, which fault is present due to the predefined temporary fault state, is also actually detected by the test module. A fault of the test module may lead, for example, to the provision of a fault output, especially of a fault output for a user of the medical device arrangement.

In an especially advantageous embodiment, the test module has a plurality of processing instances, which are configured to check the presence of a sufficient agreement between a processed test data set and the associated reference result. The different processing instances preferably operate with different algorithms during the determination of the sufficient agreement. The results of the plurality of processing units are especially advantageously compared and, for example, a sufficient agreement is determined if the plurality of processing units have determined a sufficient agreement. Especially reliable is a variant of this embodiment in which a sufficient agreement is determined only if all processing units of the plurality of processing units have determined a sufficient agreement.

In a preferred embodiment, the medical device arrangement comprises an optical monitoring system for monitoring the environment of a patient. The medical device arrangement of the invention may advantageously comprises features as disclosed in US 2017-0103524 A1. US 2017-0103524 A1 is incorporated herein by reference. The optical monitoring system preferably operates in an automated manner, so that a testing according to the present invention of the processing of data sets to be processed can especially advantageously find a fault in a processing process that can otherwise only be tested with difficulty. According to the present invention, the first analysis module of the plurality of analysis modules is, for example, the analysis module that generates an information technology representation from received sensor data from an optical sensor.

In an especially preferred variant of the above embodiment, the test data set to be processed indicates predefined image information. The reference result associated with the test data set indicates a fact represented within the predefined image information. Unusual image information may especially advantageously be used in this variant in order to make possible a fault-free operation of the optical monitoring system even in such a special case.

The security module of the medical device arrangement may especially advantageously be configured to detect a faulty behavior of an analysis module during the processing of optical sensor data by the output data set or an individual processed data set being able to be associated with a data set type from the predefined group of obviously incorrect data set types. The group of obviously incorrect data set types comprises here at least one of the following incorrect data set types: A predefined number of invalid pixels within a data set indicating an image, a sequence of essentially identical image data within a data set indicating an image sequence, a lower data rate within a data set indicating an image sequence, a signal-to-noise ratio below a predefined limit value, and an absence of identification features of an image area to be investigated within a data set indicating an image. The absence of identification features may point, for example, to the circumstance that a currently observed area of an optical sensor array does not correspond to the area to be observed. In an advantageous variant, the faulty behavior is detected by an additional sensor of the medical device arrangement and it triggers thereby a testing by the test module. The additional sensor may be, for example, an acceleration sensor or an optical sensor. The acceleration sensor may indicate, for example, a rotation or a shifting of the sensor detecting the medical data. Furthermore, the optical sensor and/or image data may be used in order to detect a shifting or rotation of the sensor detecting the medical data by a comparison of the recorded image areas in past and current data sets, for example, by checking the presence of predefined identification points, for example, of a bed frame of a patient. The identification points may be both static objects, for example, a wall or a marking on a floor, as well as dynamically determined points within image data of a plurality of sensors, from which features concerning the calibration of the plurality of sensors are obtained.

It is preferably checked before the detection that the processed data set can be associated with a data set type from the predefined group of obviously incorrect data set types whether a part of an image area to be monitored is located within an image area to be monitored by the optical sensor under a minimum. If the minimum is not reached, a faulty behavior is detected, because this indicates a change in space of the optical sensor.

In addition or as an alternative to the above embodiments pertaining to the security module, an external security unit may be provided according to the present invention, which is not a part of the medical device arrangement, but it checks the processed data sets of the analysis modules and/or the output data set in exactly the same way as does the security module in the corresponding previous embodiments. The medical device arrangement according to the present invention is configured here such that the test module can receive a corresponding fault signal of the external security unit and start a corresponding testing of one or more analysis modules.

In another embodiment, at least one analysis module of the number of analysis modules is configured to detect an internal fault state and to trigger a testing of the corresponding analysis module by the test module in case of such a detection. The test module supports hereby the internal fault detection. If there was a fault during the detection of an internal fault state, this is detected by the test module according to the present invention.

In a preferred embodiment of the medical device arrangement according to the present invention, data interfaces, the number of analysis modules and the test module are arranged in a common housing. The number of analysis modules and the test module are preferably software components here within a processing unit, for example, a processor. In an alternative embodiment, the test module and/or at least one analysis module of the number of analysis modules are arranged in at least one separate housing.

According to another aspect of the present invention, a process for testing the processing of data sets to be processed during the operation of a medical device arrangement is proposed to accomplish the above object. The process according to the present invention has the following steps:receipt of medical data sets to be processed;processing of the medical data set by a number of analysis modules, wherein each analysis module forms a processing instance for the medical data set or for the medical data set already preprocessed by at least one other analysis module;outputting of a test data set to at least one analysis module of the number of analysis modules during the operation of the medical device arrangement;processing of the test data set in the same manner in which the medical data set is processed by one or more consecutive analysis modules and outputting of a corresponding processed test data set;comparison of an outputted processed test data set with a reference result associated with the test data set;determination of a test result based on the comparison; andoutputting of corresponding warning information in case of an insufficient agreement between the processed test data set and the associated reference result.

The process according to the second aspect of the present invention has all the advantages that were already mentioned in connection with the medical device arrangement according to the present invention.

In particular, the process according to the present invention makes it also possible to detect faults within an analysis module, which were not yet present at the time at which the medical device arrangement was put into operation. An especially reliable medical device arrangement can thus be provided. The safety of a patient being treated by the medical device arrangement can be improved hereby.

The individual process steps can be carried out according to the present invention by a single processing unit, e.g., a processor, or, as an alternative, by a plurality of processing units, e.g., a plurality of processors. A software component can be associated within the processing unit with each processing step. Parts of the medical device arrangement, e.g., a processor of the medical device arrangement, may be arranged separated in space from additional parts of the medical device arrangement. In particular, the test module may be arranged separated in space from the number of analysis modules.

The present invention will be explained in more detail below on the basis of advantageous exemplary embodiments shown schematically in the figures. The various features of novelty which characterize the invention are pointed out with particularity in the claims annexed to and forming a part of this disclosure. For a better understanding of the invention, its operating advantages and specific objects attained by its uses, reference is made to the accompanying drawings and descriptive matter in which preferred embodiments of the invention are illustrated.

