the embodiment illustrated is not intended to be exhaustive or limit the invention to the precise form disclosed . it is chosen and described in order to explain the principles of the invention and its application and practical use , and thereby enable others skilled in the art to utilize the invention . the preferred embodiment of the invention is described in three sections below : hardware ; operation and software . fig1 depicts instrument 2 connected to pressurizing cuff 4 and pressurizing cuff 6 , which cuffs can be inflated to apply pressures to patient limb 8 . in fig1 photoplethysmographic blood flow sensor 10 is shown applied to a digit of limb 8 distal to cuff 4 and cuff 6 , and connected to instrument 2 . for clarity , cuff 4 and cuff 6 have been shown as separate cuffs applied to the same limb 8 , but in practice the separate cuffs may be applied to different limbs of a patient , or they may be combined as separate bladders of one dual - bladder inflatable cuff applied to a single limb of a patient , depending upon the surgical procedure being performed and the type of anesthesia employed . in many types of surgical procedures , only cuff 4 is employed and cuff 6 is not used . as can be seen in fig1 cuff 4 is connected pneumatically by tubing 12 and tubing 14 to instrument 2 . cuff 6 is connected pneumatically by tubing 16 and tubing 18 to instrument 2 . electroluminescent graphic display panel 20 ( el4737lp , planar systems , beaverton , oreg .) shown in fig1 and 2 forms part of instrument 2 and is used to display information to the user of instrument 2 . display panel 20 is employed for the selective presentation of any of the following information as described below : ( a ) menus of commands for controlling instrument 2 , from which a user may make selections ; ( b ) parameters having values which characterize the actual cuff pressures , cuff inflation times , cuff pressure reference levels and inflation time alarm limit values ; ( c ) text messages describing current alarm conditions , when alarm conditions are determined by instrument 2 ; ( d ) graphical representations of blood flow signals produced by sensor 10 ; and ( e ) messages which provide operating information to the user . switch 22 ( 61 - 01032 - 10 grayhill inc ., la grange , ill .) shown in fig1 and 2 , provides a versatile means for the user to control instrument 2 . switch 22 is a rotary selector and push - button combination switch . in combination with the electronic circuitry and software described below , switch 22 operates by producing signals in response to rotation of the selector and activation of the push - button by the user . in the preferred embodiment , rotating switch 22 allows the user to select a specific menu command or parameter for adjustment from those shown on display panel 20 . the currently selected menu command or parameter is &# 34 ; highlighted &# 34 ; by being displayed in reverse video . if a menu command is &# 34 ; highlighted &# 34 ;, pushing then releasing switch 22 causes the action indicated by the menu command to be performed . if a parameter is &# 34 ; highlighted &# 34 ;, the value of the parameter can then be adjusted by pushing and releasing switch 22 , and then rotating switch 22 : clockwise rotation will cause the value of the parameter to be increased ; counter - clockwise rotation will cause the value of the parameter to be decreased ; pushing and releasing the switch 22 again completes the adjustment of the parameter , and allows other menu commands or parameters to be selected in response to subsequent rotation of switch 22 . as can be seen in fig2 cuff 4 is connected pneumatically by tubing 12 to pressure transducer 24 , and is connected pneumatically by tubing 14 to valve assembly 26 . valve assembly 26 is shown in detail in fig1 and further described below . valve assembly 26 responds to certain signals generated by microprocessor 28 ( 80c196kb , intel corp ., santa clara , calif .) to pneumatically connect tubing 14 through tubing 32 to gas pressure reservoir 34 , a sealed pneumatic chamber having a fixed volume of 500 ml . valve assembly 26 also responds to other signals generated by microprocessor 28 to pneumatically connect tubing 14 to atmosphere , allowing the release of pressure in cuff 4 . valve sensing circuit 1020 ( fig1 ) included in valve assembly 26 responds to a cuff 4 mode signal generated by microprocessor 28 which is indicative of a predefined cuff mode ; in the preferred embodiment three cuff modes for cuff 4 are defined : &# 34 ; cuff inflating &# 34 ; mode , &# 34 ; cuff regulating &# 34 ; mode and &# 34 ; cuff deflating &# 34 ; mode . the level to which the cuff 4 mode signal is set by microprocessor 28 is determined by user input and microprocessor 28 . pressure transducer 24 generates a cuff 4 pressure signal which indicates the pressure of gas in cuff 4 , and the cuff 4 pressure signal is then communicated to an analog to digital converter ( adc ) input of microprocessor 28 which digitizes the cuff 4 pressure signal . when the cuff 4 mode signal is at a level indicative of &# 34 ; cuff inflating &# 34 ; mode , microprocessor 28 acts to increase the level of pressure within cuff 4 from a level near atmospheric pressure to a level near the reference pressure represented by the cuff 4 reference pressure signal , by generating signals for the actuation of valves 1002 and 1004 ( fig1 ) within valve assembly 26 , thereby pneumatically connecting cuff 4 to a gas pressure reservoir 34 . when the cuff 4 mode signal is at a level indicative of &# 34 ; cuff regulating &# 34 ; mode microprocessor 28 acts to regulate the pressure within cuff 4 near the reference pressure represented by the cuff 4 reference pressure signal by generating signals for the selective actuation of either valves 1002 or 1006 within valve assembly 26 , thereby pneumatically connecting cuff 4 to gas pressure reservoir 34 or pneumatically conecting cuff 4 to atmosphere . when the cuff 4 mode signal is at a level indicative of &# 34 ; cuff deflating &# 34 ; mode , microprocessor 28 acts to reduce the level of pressure within cuff 4 to a level near atmospheric pressure by generating signals for the actuation of valves 1006 and 1010 within valve assembly 26 , thereby pneumatically connecting cuff 4 to atmosphere . to alert the user if the pressure in cuff 4 can not be regulated within a pre - assigned limit of ± 15 mmhg , microprocessor 28 compares the cuff pressure signal from cuff pressure transducer 24 to the reference pressure signal for cuff 4 : if the cuff pressure signal exceeds the reference signal by 15 mmhg or more , microprocessor 28 generates an alarm signal indicating over - pressurization of cuff 4 . if the cuff pressure signal is less than the reference pressure signal by a difference of 15 mmhg or more , microprocessor 28 generates an alarm signal indicating under - pressurization of cuff 4 . microprocessor 28 also tracks the inflation time for cuff 4 , by maintaining a counter indicating the length of time that cuff 4 has been pressurized . microprocessor 28 compares this actual cuff inflation time to an inflation time limit for cuff 4 , and if the actual cuff inflation time exceeds the inflation time limit , microprocessor 28 generates an alarm signal indicating that the inflation time limit for cuff 4 has been exceeded . as depicted in fig2 if cuff 6 is required for the surgical application , cuff 6 is connected pneumatically by tubing 16 to pressure transducer 36 , and is connected pneumatically by tubing 18 to valve assembly 38 . valve assembly 38 has the same structure as valve assembly 26 which is described in detail below and which is shown in fig1 . valve assembly 38 responds to signals described below which are generated by microprocessor 28 , to pneumatically connect tubing 18 through tubing 32 to gas pressure reservoir 34 . valve assembly 38 also responds to other signals described below which are generated by microprocessor 28 to pneumatically connect tubing 18 to atmosphere , allowing the release of pressure in cuff 6 . valve assembly 38 responds to a cuff 6 mode signal generated by microprocessor 28 which is indicative of a predefined cuff mode ; in the preferred embodiment three modes for cuff 6 are predefined : &# 34 ; cuff inflating &# 34 ; mode , &# 34 ; cuff regulating &# 34 ; mode , and &# 34 ; cuff deflating &# 34 ; mode . the level to which the cuff 6 mode signal is set by microprocessor 28 is determined by user input and microprocessor 28 . pressure transducer 36 generates a cuff 6 pressure signal which indicates the pressure of gas in cuff 6 , and the cuff 6 pressure signal is then communicated to an analog to digital converter ( adc ) input of microprocessor 28 which digitizes the cuff 6 pressure signal . when the cuff 6 mode signal is at a level indicative of &# 34 ; cuff inflating &# 34 ; mode , microprocessor 28 acts to increase the level of pressure within cuff 6 from a level near atmospheric pressure to a level near the reference pressure represented by the cuff 6 reference pressure signal , by generating signals for the actuation of selected valves within valve assembly 38 . when the cuff 6 mode signal is at a level indicative of &# 34 ; cuff regulating &# 34 ; mode microprocessor 28 acts to regulate the pressure within cuff 6 near the reference pressure represented by the cuff 6 reference pressure signal by generating signals for the actuation of selected valves within valve assembly 38 . when the cuff 6 mode signal is at a level indicative of &# 34 ; cuff deflating &# 34 ; mode , microprocessor 28 acts to reduce the level of pressure within cuff 6 to a level near atmospheric pressure by generating signals for the actuation of selected valves within valve assembly 38 . to alert the user if the pressure in cuff 6 can not be regulated within a pre - assigned limit of ± 15 mmhg , microprocessor 28 compares the cuff pressure signal from cuff pressure transducer 36 to the reference pressure signal for cuff 6 : if the cuff pressure signal exceeds the reference signal by 15 mmhg or more , microprocessor 28 generates an alarm signal indicating over - pressurization of cuff 6 . if the cuff pressure signal is less than the reference pressure signal by a difference of 15 mmhg or more , microprocessor 28 generates an alarm signal indicating under - pressurization of cuff 6 . microprocessor 28 also tracks the inflation time for cuff 6 , by maintaining a counter indicating the length of time that cuff 6 has been pressurized . microprocessor 28 compares this actual cuff inflation time to an inflation time limit for cuff 6 , and if the actual cuff inflation time exceeds the inflation time limit , microprocessor 28 generates an alarm signal indicating that the inflation time limit for cuff 6 has been exceeded . as shown in fig2 pneumatic pump 40 ( e series 801105 , gilian instrument corp . caldwell , n . j .) is pneumatically connected to reservoir 34 by tubing 42 . pump 40 acts to pressurize reservoir 34 in response to control signals from microprocessor 28 communicated through pump driver 44 . reservoir pressure transducer 46 is pneumatically connected through tubing 48 to reservoir 34 and generates a reservoir pressure signal indicative of the pressure in reservoir 34 . the reservoir pressure signal is communicated to an adc input of microprocessor 28 . in response to this reservoir pressure signal and a reservoir pressure reference signal provided as described below , microprocessor 28 generates control signals for pump driver 44 and regulates the pressure in reservoir 34 to a pressure near the reference pressure represented by the reservoir reference pressure signal as described below . photoplethysmographic blood flow sensor 10 is placed on a portion of a limb distal to cuff 4 , and distal to cuff 6 if cuff 6 is also employed , to sense blood flow beneath the flow sensor 10 . fig1 illustrates a typical location of sensor 10 for the lower limb . sensor 10 generates a blood flow signal indicative of blood flow beneath the sensor , which is processed by amplifier 50 and communicated to an adc input of microprocessor 28 , as depicted in fig2 . real time clock 52 shown in fig2 maintains the current time and date , and includes a battery as an alternate power source such that clock operation continues during any interruption in the supply of electrical power from power supply 54 required for the normal operation of instrument 2 . microprocessor 28 communicates with real time clock 52 for both reading and setting the current time and date . configuration register 56 shown in fig2 is comprised of non - volatile memory ( 24lc02 , microchip technology , chandler ariz .) operating in conjunction with microprocessor 28 as described below to contain previously recorded cuff reference pressure levels and inflation time alarm limits for use by microprocessor 28 as described below , and retains these recorded levels of these parameters indefinitely in the absence or interruption of electrical power from power supply 54 required for the normal operation of instrument 2 . the levels of the cuff reference pressures and inflation time limits initially recorded in configuration register 56 are given in the table below : __________________________________________________________________________ cuff 4 reference cuff 4 inflation cuff 6 reference cuff 6 inflationoperating mode pressure time limit pressure time limit__________________________________________________________________________single cuff mode 200 mmhg 60 min . -- -- dual cuff mode 200 mmhg 60 min . 200 mmhg 60 min . ivra dual bladder 250 mmhg 45 min 250 mmhg 45 min . cuff mode__________________________________________________________________________ microprocessor 28 communicates with configuration register 56 to record and retrieve levels of the configuration parameters recorded in configuration register 56 as described below . event register 58 shown in fig2 records &# 34 ; events &# 34 ; which are defined in the software of the preferred embodiment to be : ( a ) actions by the user to inflate a cuff , deflate a cuff , adjust the level of a cuff reference pressure signal , adjust the level of cuff inflation time limit signal , adjust the level of the operating mode signal or silence an audio alarm ; ( b ) alarm events , resulting from microprocessor 28 generating an alarm signal as described above ; and ( c ) events associated with determining a cuff pressure automatically as described below . event register 58 comprises event register memory 60 ( 28c64a microchip technology , chandler , ariz . ), and event register printer 62 . microprocessor 28 communicates with event register 58 to record events as they occur . microprocessor 28 records an event by communicating to event register 58 : the time of the event as read from real time clock 52 ; a value identifying which one of a specified set of events occurred as determined by microprocessor 28 ; and the values at the time of the event of the following parameters : operating mode signal , cuff 4 pressure signal ; cuff 4 pressure reference signal ; cuff 4 inflation time , cuff 4 inflation time limit ; cuff 6 pressure signal ; cuff 6 pressure reference signal ; cuff 6 inflation time , cuff 6 inflation time limit ; and recommended cuff pressure , when the event occurred . entries are recorded in event register 58 by storing values in event register memory 60 and by printing these values for the user by means of event register printer 62 . event register memory 60 retains information indefinitely in the absence or interruption of electrical power from power supply 54 required for the normal operation of instrument 2 . microprocessor 28 communicates with electroluminescent display panel 20 through display controller 64 to display information as described above . user input is by means of switch 22 . signals from switch 22 arising from rotation and push - button contact closure in switch 22 are communicated to microprocessor 28 . microprocessor 28 will , in response to generated alarm signals alert the user by text and graphic messages shown on display panel 20 and by audio tones . electrical signals having different frequencies to specify different alarm signals and conditions are produced by microprocessor 28 , amplified by audio amplifier 66 and converted to audible sound by loud speaker 68 shown in fig2 . power supply 54 provides regulated dc power for the normal operation of all electronic and electrical components . shown in fig1 and described below is a detailed block diagram of valve assembly 26 shown in fig2 . when actuated , valve 1002 ( evo - 3 - 60 v clippard instrument laboratory , cincinnati , ohio ) pneumatically connects tubing 32 to tubing 14 , permitting the flow of gas from reservoir 34 shown in fig2 to cuff 4 . valve 1004 ( 201a3 / 30f burkert contromatic corp ., orange , calif .) when actuated also pneumatically connects tubing 32 to 14 . the valve orifice of valve 1004 is substantially larger than the valve orifice of valve 1002 and therefore permits gas to flow into cuff 4 at a greater rate than valve 1002 . valve 1006 ( evo - 3 - 60v clippard instrument laboratory , cincinnati , ohio ) when actuated pneumatically connects tubing 14 to tubing 1008 . tubing 1008 is open to atmosphere and permits gas to be released from cuff 4 . valve 1010 ( 201a3 / 30f burkert contromatic corp ., orange , calif .) when actuated also pneumatically connects tubing 14 to tubing 1008 . the valve orifice of valve 1010 is substantially larger than the valve orifice of valve 1006 and therefore permits gas to be released from cuff 4 at a greater rate than valve 1006 . this combination of valves permits cuff 4 to be inflated and deflated rapidly through valves 1004 , 1010 , and also permits the pressure in cuff 4 to be regulated accurately when inflated through valves 1002 , 1006 . valve drivers 1012 , 1014 , 1016 and 1018 , under the control of signals from microprocessor 28 , complete an electrical circuit allowing electrical power to be applied for the actuation of valves 1002 , 1004 , 1006 and 1010 respectively . valve sensing circuit 1020 in valve assembly 26 monitors the actuation of valves 1002 , 1004 , 1006 and 1010 by monitoring the voltage levels between the valve drivers and the valves . if any one of the predetermined set of undesired valve actuations described below is detected , valve sensing circuit 1020 responds by generating a &# 34 ; fault &# 34 ; signal that is sent to microprocessor 28 . valve circuit 1020 also responds by disconnecting the supply of electrical power to all valves 1002 , 1004 , 1006 , and 1010 , thus de - actuating valves 1002 , 1004 , 1006 and 1010 . de - actuating valves 1002 , 1004 , 1006 and 1010 , ensures that the pressure within cuff 4 will remain stable and will not increase or decrease to unsafe levels as the result of an undesired valve actuation . microprocessor 28 responds to the &# 34 ; fault &# 34 ; signal by generating an alarm signal indicating that a valve related fault has occurred . undesired valve actuations may result from the failure of any one of valve drivers 1012 , 1014 , 1016 or 1018 , or failure of any one of valves 1002 , 1004 , 1006 and 1010 , or a failure in microprocessor 28 , or a software error . the table below summarizes the undesired combinations of valve actuations which are detected by valve sensing circuit 1020 for the three valid levels of the cuff mode signal . ______________________________________cuff modesignal valve 1002 valve 1004 valve 1006 valve 1010______________________________________cuff deflating actuated x x xmodecuff deflating x actuated x xmodecuff deflating x x de - actuated de - actuatedmodecuff inflating x x actuated xmodecuff inflating x x x actuatedmodecuff inflating de - actuated de - actuated x xmodecuff regulat - actuated x actuated xing modecuff regulat - x actuated x xing modecuff regulat - x x x actuateding mode______________________________________ x = either actuated or deactuated in the preferred embodiment , valve sensing circuit 1020 depicted in fig1 also responds to a cuff mode signal generated by microprocessor 28 . in the preferred embodiment , the level of the cuff mode signal for cuff 4 corresponds to one of three predefined levels , each of which is indicative of one of three modes : &# 34 ; cuff inflating &# 34 ; mode , &# 34 ; cuff regulating &# 34 ; mode and &# 34 ; cuff deflating mode &# 34 ;. the cuff regulating mode refers to a mode of operation in which the cuff is maintained at a preselected pressure by the system . the level of the cuff mode signal determines which combinations of valve actuations will be classified as undesired by the valve sensing circuit 1020 . upon detecting an undesired valve combination , or upon detecting a cuff mode signal having a level other than one of three predefined levels indicative of the three valid cuff modes , valve sensing circuit 1020 generates a &# 34 ; fault &# 34 ; signal and disconnects the electrical power supplied to valves 1002 , 1004 , 1006 and 1010 , thereby de - actuating valves 1002 , 1004 , 1006 and 1010 . deactuation of these valves maintains the prior status of the system , and reduces the likelihood of occurences of such undesired events as simultaneous inflation and deflation of a cuff . an invalid cuff mode signal may result from the failure of microprocessor 28 or a software error . at start - up of instrument 2 , when instrument 2 is activated by supply of electrical power through power supply 54 microprocessor 28 configures instrument 2 by setting predetermined parameters to the levels recorded in configuration register 56 . configuration register 56 contains a previously recorded level for the operating mode signal and , for each of the three possible levels of the operating mode signal , previously recorded level for the cuff reference pressure and cuff inflation time alarm limit for each cuff , as described elsewhere . the user of instrument 2 can alter a level of a parameter recorded in configuration register 56 , by selecting the parameter and changing its level as described below . in operation , a user of the preferred embodiment communicates with instrument 2 by using switch 22 to choose commands for controlling instrument 2 from menus of commands , and by using switch 22 to set the level of parameters displayed on display panel 20 , as described above and in the software description below . three distinct modes of operation of the preferred embodiment are provided in the preferred embodiment : &# 34 ; single cuff mode &# 34 ;, &# 34 ; dual cuff mode &# 34 ; and &# 34 ; ivra dual - bladder cuff mode &# 34 ;. microprocessor 28 controls the operation of instrument 2 in response to the level of the operating mode signal as described below . the level of the operating mode signal is set by microprocessor 28 retrieving a previously recorded level from configuration register 56 and can be altered by the user by means of switch 22 as described below . fig3 a shows the layout of display panel 20 for &# 34 ; single cuff mode &# 34 ;, wherein only cuff 4 is actuated and used in a surgical procedure . as depicted in fig3 a , a single display region 70 labeled main cuff is shown on display panel 20 and predetermined menu 72 is also displayed for the user . menu 72 enables choices to be made by the user for : temporarily silencing audio alarms ; printing on event register printer 62 the events recorded in event register memory 60 ; initiating the determination of recommended cuff pressure ; selecting an operating mode , or obtaining operating instructions . menu 72 is depicted in fig3 a with the menu command &# 34 ; select operating mode &# 34 ; shown in reverse video , indicating that it has been selected by the user of instrument 2 . as shown in fig3 a , within display region 70 labeled main cuff parameters and menu commands for controlling cuff 4 are displayed , and all displayed parameters are continually updated by microprocessor 28 . the displayed parameters are : the current level of cuff pressure , cuff pressure reference level , cuff inflation time and inflation time alarm limit level . the menu commands for control of cuff 4 are : &# 34 ; inflate &# 34 ; and &# 34 ; deflate &# 34 ;. if the user selects the command &# 34 ; inflate &# 34 ;, instrument 2 will regulate the pressure in cuff 4 near the level of the cuff 4 reference pressure signal as described above . if the user selects the command &# 34 ; deflate &# 34 ; instrument 2 will release the pressure in cuff 4 causing cuff 4 to deflate to atmospheric pressure . in &# 34 ; single cuff mode &# 34 ; all alarm and event messages refer only to cuff 4 . fig3 b depicts the layout of display panel 20 for &# 34 ; dual cuff mode &# 34 ;, corresponding to the second of three predetermined levels of the operating mode signal . in &# 34 ; dual cuff mode &# 34 ; both cuff 4 and cuff 6 are actuated . as illustrated in fig3 b two independent display regions are shown on display panel 20 , as well as the predetermined user menu 72 described above . one region 70 is labeled main cuff , within which region are displayed the parameters and menu commands for control of cuff 4 . the second region 74 is labeled second cuff , within which region are displayed the parameters and controls for cuff 6 . the parameters and controls displayed in region 74 are identical to those described above for cuff 4 , except the parameters and controls displayed in region 74 refer to cuff 6 . in &# 34 ; dual cuff mode &# 34 ;, the inflation and deflation of cuff 4 is independent of the inflation and deflation of cuff 6 . all alarm and event messages refer either to cuff 4 , the main cuff or to cuff 6 , the second cuff . when cuff 6 is inflated in the &# 34 ; dual cuff mode &# 34 ;, the operating mode signal cannot be changed by the user until such time as cuff 6 has been deflated . fig3 c depicts the layout of display panel 20 for the &# 34 ; ivra dual - bladder cuff mode &# 34 ;, corresponding to the third level of the operating mode signal . this mode can only be selected by the user when both cuff 4 and cuff 6 are deflated . the &# 34 ; ivra dual - bladder cuff mode &# 34 ; is the preferred mode for selection by the user when intravenous regional anesthesia ( ivra ) also known as bier block anesthesia , is employed . in &# 34 ; ivra dual - bladder cuff mode &# 34 ; both cuff 4 and cuff 6 are actuated . as shown in fig3 c two independent display regions 76 and 78 are shown on display panel 20 , also shown is predetermined user menu 72 having the structure and function as described above . region 76 , labeled proximal cuff contains displays of parameters and controls for cuff 4 . region 78 , labeled distal cuff contains displays of the parameters and controls for cuff 6 . alarm and event messages are generated to refer separately either to cuff 4 , the proximal cuff , or to cuff 6 the distal cuff . when the preferred embodiment is operating in &# 34 ; ivra dual - bladder mode &# 34 ;, the operating mode signal cannot be changed by the user while either cuff 4 or cuff 6 is inflated . in &# 34 ; ivra dual - bladder cuff mode &# 34 ; a safety interlock is activated to reduce the probability of unintended and inadvertent deflation of both cuffs during a surgical procedure involving ivra . the safety interlock operates as follows : if the user initiates deflation of cuff 4 while cuff 6 is deflated , or if the user initiates deflation of the cuff 6 while cuff 4 is deflated , a safety interlock signal is produced to prevent the initiated deflation and a visual and audible warning is given via display panel 20 and speaker 68 to indicate to the user that the action the user has initiated may be unsafe , i . e . that the action would result in cuff 4 and cuff 6 being deflated at a time in a surgical procedure involving ivra when liquid anesthetic agent contained in blood vessels distal to cuff 4 and cuff 6 may be released into systemic circulation . a menu command is displayed on display panel 20 for enabling the user to confirm that deflation of the cuff is intended . to continue with the initiated deflation , the user must intentionally confirm that deflation of the cuff is intended by means of a distinct and discrete manipulation of switch 22 by the user ; in the preferred embodiment this distinct confirmation action requires the user to rotate switch 22 to select the confirmation menu command and then depress switch 22 within a 5 sec time period , at which confirmation the cuff is deflated . alternatively if the user does not confirm the initiated deflation through a discrete manipulation and actuation of switch 22 within the 5 sec time period , then the initiated deflation is not carried out and the menu command for enabling the user to confirm that deflation was intended is removed from display panel 20 . if the user has made an automatic determination of recommended cuff pressure for cuff 4 and cuff 6 as described below , the safety interlock also operates as follows : if the user initiates deflation of cuff 4 or attempts to reduce the cuff 4 reference pressure to a level below the determined limb occlusion pressure for cuff 4 while the cuff 6 reference pressure or cuff 6 pressure is below the determined limb occlusion pressure for cuff 6 or attempts to deflate cuff 6 or reduce the cuff 6 reference pressure to a level below the determined limb occlusion pressure for cuff 6 while the cuff 4 reference pressure or cuff 4 pressure is below the determined limb occlusion pressure for cuff 4 , a safety interlock signal is produced and a visual and audible warning is given via display panel 20 and speaker 68 to indicate to the user that the action the user has initiated may be unsafe , i . e . that the action would result in cuff 4 and cuff 6 being at a pressure which would allow blood flow at a time in a surgical procedure involving ivra when liquid anesthetic agent contained in blood vessels distal to cuff 4 and cuff 6 may be released into systemic circulation . a menu command is displayed on display panel 20 for enabling the user to confirm that deflation of the cuff or cuff reference pressure adjustment is intended . to continue with the initiated deflation or cuff reference pressure adjustment , the user must intentionally confirm that deflation or adjustment of the cuff reference pressure to a level below limb occlusion pressure is intended by means of a distinct and discrete manipulation of switch 22 by the user ; in the preferred embodiment this confirmation requires the user to rotate and then depress switch 22 within a 5 sec time period , at which confirmation deflation or the cuff reference pressure adjustment may proceed . alternatively if the user does not confirm the initiated cuff deflation or cuff reference pressure adjustment through a discrete manipulation and actuation of switch 22 within the 5 sec time period , then the initiated deflation or adjustment is not carried out and the menu command for enabling the user to confirm that reduction of cuff pressure was intended is removed from display panel 20 in this manner , the safety interlock mechanism for ivra detects a potentially unsafe action initiated by the operator &# 39 ; s selection of a command , produces a safety interlock signal and generates visual and audible indications to warn the operator of the potentially unsafe action which has been initiated , and prevents the initiated action from being implemented unless and until a distinct confirmation action is performed by the operator . although the preferred embodiment of the safety interlock mechanism is described above , it will be appreciated by those normally skilled in the art that alternate mechanisms and embodiments may be employed . for example , an alternate embodiment of the safety interlock mechanism can be employed in any dual cuff tourniquet apparatus to detect any potentially unsafe attempt to deflate or reduce the pressure in one of the dual cuffs to a non - zero level , if the result of that attempt to depressurize or reduce the pressure in the cuff may be to allow the release of anesthetic agent past the cuff and into systemic circulation when the dual cuff tourniquet apparatus is used in conjunction with ivra . also , an alternate embodiment of the safety interlock mechanism may employ only an audible warning , or only a visual warning , or may generate no warning directly but may instead make the safety interlock signal available for integration with other monitoring and display systems in the operating room . further , an alternate embodiment of the safety interlock apparatus may employ other means for enabling the user to confirm that a potentially unsafe reduction of cuff pressure is intended ; for example , a separate confirmation switch may be provided for actuation by the user at any time after the detection of the potentially unsafe attempt , or confirmation may require that multiple actuations of the same switch be performed by the user within a specified time period , or confirmation may require that two switches be depressed simultaneously by the user . to provide the user of instrument 2 with a detailed record of applied pressures and alarm conditions , event register 58 is provided . &# 34 ; events &# 34 ; which are defined in the software of the preferred embodiment to be : ( a ) actions by the user to inflate a cuff , deflate a cuff , adjust the level of a cuff reference pressure signal , adjust the level of cuff inflation time limit signal , adjust the level of the operating mode signal or silence an audio alarm ; ( b ) alarm events , resulting from microprocessor 28 generating an alarm signal as described above ; and ( c ) events associated with determining a cuff pressure automatically as described below . microprocessor 28 communicates with event register 58 to record events as they occur . microprocessor 28 records an event by communicating to event register 58 : the time of the event as read from real time clock 52 ; a value identifying which one of a specified set of events occurred as determined by microprocessor 28 ; and the values at the time of the event of the following parameters : operating mode signal , cuff 4 pressure signal ; cuff 4 pressure reference signal ; cuff 4 inflation time , cuff 4 inflation time limit ; cuff 6 pressure signal ; cuff 6 pressure reference signal ; cuff 6 inflation time , cuff 6 inflation time limit ; and recommended cuff pressure , when the event occurred . entries are recorded in event register 58 by storing values in event register memory 60 and by printing these values for the user by means of event register printer 62 . in operation , the user can erase from the event register 58 previously registered events and prepare event register 58 to retain new events . the user , by means of selecting a menu command shown on display panel 20 , can cause descriptions of the events recorded in event register memory 60 to be printed on event register printer 62 . for each recorded event , microprocessor 28 causes to be printed the time of the event , a text message describing the event , and the parameters recorded at the time of the event . in operation prior to the inflation of cuff 4 the user may instruct microprocessor 28 by using switch 22 to select the &# 34 ; recommend cuff pressure &# 34 ; command on menu 72 , thus beginning the automatic determination of a recommended cuff pressure level for cuff 4 . to determine a recommended cuff pressure microprocessor 28 first ensures that an adequate blood flow signal is being produced by sensor 10 . microprocessor 28 then sets to 50 mmhg the value of the cuff pressure reference signal for cuff 4 which causes the pressure in cuff 4 to increase to 50 mmhg . next , microprocessor 28 measures and stores the level of the blood flow signal being produced by sensor 10 . microprocessor 28 then increases , in discrete steps of 10 mmhg or 5 mmhg as described below , the value of the cuff 4 pressure reference signal up from 50 mmhg . if the level of the current blood flow signal from sensor 10 is greater than or equal to 50 percent of the previously stored blood flow signal level , microprocessor 28 increases the cuff 4 pressure reference signal in steps of 10 mmhg . if the level of the current blood flow signal from sensor 10 is less than 50 percent of the previously stored blood flow signal , microprocessor 28 increases the cuff 4 pressure reference signal in steps of 5 mmhg . microprocessor 28 continues to increase the pressure reference signal for cuff 4 , and thereby the pressure in cuff 4 , until the pressure reference signal for cuff 4 exceeds 300 mmhg or the level of the current blood flow signal from sensor 10 is less than 3 percent of the previously stored blood flow signal level . if the cuff 4 reference level exceeds 300 mmhg the determination of a recommended cuff pressure is terminated and the user of instrument 2 informed by messages displayed on display panel 20 that the determination was unsuccessful . the level of the pressure signal from cuff 4 corresponding to the lowest level at which the level of the current blood flow signal from sensor 10 is less than 3 percent of the previously stored blood flow signal level is displayed as the limb occlusion pressure and is used to calculate the recommended cuff pressure , as follows . if the limb occlusion pressure is less than or equal to 130 mmhg a safety margin of 40 mmhg is added to estimate the recommended cuff pressure ; if the limb occlusion pressure is greater than 130 mmhg and no greater than 190 mmhg , a safety margin of 60 mmhg is added to estimate the recommended cuff pressure ; and if the limb occlusion pressure is greater than 190 mmhg , a safety margin of 80 mmhg is added to estimate the recommended cuff pressure . this recommended cuff pressure level is displayed on display panel 20 and the cuff pressure reference signal is adjusted by microprocessor 28 to be equivalent to the level of the recommended cuff pressure . additionally , prior to the inflation of cuff 6 when cuff 6 is used in addition to cuff 4 for either &# 34 ; ivra dual bladder cuff model &# 34 ; or &# 34 ; dual cuff mode &# 34 ;, the user may instruct microprocessor 28 by means of switch 22 to automatically determine the recommended cuff pressure level for cuff 6 . the process for determining the recommended cuff pressure for cuff 6 is the same as that described above for cuff 4 . fig4 , 6 , 7 , 8 and 9 are software flow charts depicting the sequence of operations which microprocessor 28 is programmed to carry out in the preferred embodiment of the invention . in order to simplify the discussion of the software , a detailed description of each software subroutine and of the control signals which the software produces to actuate the hardware described above is not provided . it will however be understood by those skilled in the art that , for example , in order to display characters and graphics on display panel 20 , microprocessor 28 must generate appropriate signals and communicate them to display controller 64 . functions or steps carried out by the software are described below and related to the flow charts via parenthetical reference numerals in the text . software for the preferred embodiment was developed using the c programming language and compiled with c96 ( intel corp . santa clara , calif .). the main program software is depicted in fig4 , 6 and 7 , and the utility software subroutines &# 34 ; read selector &# 34 ; and &# 34 ; regulate &# 34 ; are shown in fig8 and 9 respectively . fig4 shows the initialization operations carried out by the main program . fig5 shows the operations taken to adjust and record user configuration parameters . fig6 shows the main program control loop entered at the completion of the initialization operations . fig7 shows the operation of the safety interlock subroutine . as shown in fig4 the program commences ( 400 ) when power is supplied to microprocessor 28 by initializing microprocessor 28 for operation with the memory system and circuitry and hardware of the preferred embodiment . display controller 64 is then initialized ( 402 ) with the parameters required for operation with display panel 20 . control is then passed to a self - test subroutine ( 404 ). the self - test subroutine displays a &# 34 ; self test in progress &# 34 ; message on display panel 20 and performs a series of diagnostic tests to ensure proper operation of microprocessor 28 and its associated hardware . should any diagnostic test fail ( 406 ), an error code is displayed on display panel 20 ( 408 ) and further operation of the system is halted ( 410 ); if no errors are detected , control is returned to the main program . as can be seen in fig4 after the &# 34 ; self - test &# 34 ; has been completed successfully , control is next passed to a subroutine ( 412 ) which retrieves from configuration register 56 the levels of previously recorded configuration parameters . the parameters are : a level for the operating mode signal and , for each of the three possible levels of the operating mode signal , a level for the cuff reference pressure and cuff inflation time alarm limit for each cuff . upon completion , this subroutine returns control to the main program . control is next passed to a subroutine ( 414 ) which tests the retrieved configuration parameters for validity by : ( 1 ) calculating a checksum for the retrieved levels of the parameters and comparing it to a checksum previously calculated and recorded in configuration register 56 ; ( 2 ) testing each retrieved parameter level to ensure it is within pre - defined allowable limits . if any of the retrieved parameters are found to be invalid ( 416 ) an error message is displayed on display panel 20 ( 418 ), and configuration parameters are set to default levels defined in software ( 420 ). control is then returned to the main program , where the operating mode signal , the levels for the cuff reference pressures , and the alarm limits are set to the values of the previously recorded configuration parameters ( 422 ). as shown in fig4 the software subroutine &# 34 ; read selector &# 34 ; which processes user input from switch 22 and sends characters to event register printer 62 , is then scheduled to run every millisecond ( 424 ). this subroutine is initiated by the software timer interrupt system of microprocessor 28 and communicates with the main program by means of global variables . the flow chart for this subroutine is shown in detail in fig8 and is discussed below . the software subroutine &# 34 ; regulate &# 34 ;, for controlling the pneumatic system and inputting signals from photoplethysmographic blood flow sensor 10 , is then scheduled to run every 30 milliseconds ( 426 ). this subroutine is initiated by the software timer interrupt system of microprocessor 28 and communicates with the main program by means of global variables . the flow chart for this subroutine is shown in detail in fig9 and is discussed below . the flow chart for the main program is continued in fig5 . as shown in fig5 the operation of the main program continues by passing control to a subroutine ( 500 ) which displays on display panel 20 basic operating instructions and menu commands which allow the user either to choose a menu command to &# 34 ; continue &# 34 ; with the operation of the preferred embodiment or to choose a menu command to &# 34 ; configure &# 34 ; the preferred embodiment . control is then passed to a &# 34 ; process user input &# 34 ; subroutine ( 502 ) for processing user input , as follows : the subroutine communicates with the subroutine &# 34 ; read selector &# 34 ; via global variables , updates displayed menu choices and values of parameters in response to the rotation and activation of switch 22 ; and passes control to other subroutines or parts of the main program based on menu commands selected by the user . the processing of user input by this subroutine continues until the user selects either the &# 34 ; configure &# 34 ; ( 504 ) or &# 34 ; continue &# 34 ; ( 506 ) menu commands . if the user selects the &# 34 ; continue &# 34 ; menu command control returns to the main program and continues as detailed in fig6 . if the user chooses the &# 34 ; configure &# 34 ; menu command , control is passed to a subroutine ( 508 ) which displays the levels of parameters retained in configuration register 56 and associated menu commands ; these parameters and menu commands are depicted in display region 80 labeled configuration menu and menu 82 shown in fig3 d . control is next passed to a subroutine ( 510 ) for processing user input similar to the subroutine described above ; this subroutine updates the displayed parameters and menu commands to indicate adjustments made by the user . the processing of user input continues until a menu command for exiting the configuration menu is selected by the user ( 512 ), as shown in menu 82 in fig3 d . as can be seen in fig5 control is then passed to a subroutine ( 514 ) which calculates a checksum for the levels of the configuration parameters and records the levels of the configuration parameters along with their associated checksum in configuration register 56 . control is then returned to the subroutine ( 500 ) for displaying basic operating instructions and &# 34 ; continue &# 34 ; and &# 34 ; configure &# 34 ; menu commands , and operation continues as described above . the flow chart depicted in fig6 shows the main program control loop entered in response to the &# 34 ; continue &# 34 ; menu command being selected as described above . as shown in fig6 the main program then enters a loop which continues until electrical power required for the operation of microprocessor 28 is interrupted . as depicted in fig6 control is first passed to a subroutine ( 600 ) which displays on display panel 20 menu commands for controlling the operation of the preferred embodiment . these menu commands are shown if fig3 a as menu 72 , which enables choices to be made by the user for : temporarily silencing audio alarms ; printing on event register printer 62 the events recorded in event register memory 60 ; initiating the determination of recommended cuff pressure ; selecting an operating mode , or obtaining operating instructions . control is then returned to the main program . control is next passed to a subroutine ( 602 ) which displays on display panel 20 operating parameters and controls referring only to cuff 4 . the operating parameters include the current level of cuff pressure , cuff pressure reference level , inflation time and inflation time alarm limit . the menu commands for control of cuff 4 comprise : menu commands for cuff inflation and cuff deflation . these operating parameters and controls are depicted in display region 70 labeled main cuff shown in fig3 a . upon completion of this subroutine control is returned to the main program . if the operating mode signal described above is set to &# 34 ; dual cuff mode &# 34 ; ( 604 ), control is passed to a subroutine ( 606 ) which displays on display panel 20 the operating parameters and menu commands for controlling cuff 6 . the parameters and menu commands are identical to those described above for cuff 4 . these operating parameters and controls are depicted in display region 74 labeled second cuff shown in fig3 a . upon completion this subroutine returns control to the main program . if the operating mode signal described above is set to &# 34 ; ivra dual bladder cuff mode &# 34 ; ( 608 ) control is passed to a subroutine ( 610 ) which displays on display panel 20 the operating parameters and menu commands for controlling cuff 6 . control is then passed to a subroutine ( 612 ) which identifies the controls and parameters for cuff 4 as referring to the proximal cuff and the controls and parameters for cuff 6 as referring to the distal . this is depicted in fig3 c by display region 76 labeled proximal cuff and display region 78 labeled distal cuff . as shown in fig6 control is next passed to a &# 34 ; safety interlock &# 34 ; subroutine ( 614 ) to reduce the probability of unintended and inadvertent deflation of both cuff 4 and cuff 6 during a surgical procedure involving ivra . the &# 34 ; safety interlock &# 34 ; subroutine functions as described below and depicted in fig7 . the safety interlock subroutine shown in fig7 commences by testing whether depressurization of cuff 4 to a potentially unsafe low pressure has been initiated by the user ( 700 ), either by selecting a menu command for the deflation of cuff 4 and activating switch 22 , or by selecting the cuff 4 reference pressure and adjusting it to a pressure below a level representing the minimum pressure which will stop blood flow and the release of anesthetic agent past cuff 4 ; if so , the state of cuff 6 is then tested ( 702 ) and if cuff 6 is deflated or pressurized below a level representing the minimum pressure which will stop blood flow and the release of anesthetic agent past cuff 6 , a safety interlock signal is generated ( 704 ) which prevents the initiated deflation of cuff 4 or initiated cuff 4 reference pressure adjustment from occurring in the absence of user confirmation ; otherwise the safety interlock signal is not produced and cuff 4 deflation or reference pressure adjustment proceeds ( 706 ). in the preferred embodiment , a cuff is defined to be deflated if the cuff pressure is less than a level of 10 mmhg , and the level representing the minimum pressure which will stop blood flow and the release of anesthetic agent past a cuff is set to be the limb occlusion pressure for that cuff determined automatically as described above . it will be appreciated by those normally skilled in the art that alternate mechanisms and embodiments may be employed for determining and setting the pressure levels used in testing the states of cuffs ; for example , the levels may be preset to other pressures , or the preset levels may be adjustable by a user . after producing a safety interlock signal ( 704 ) control is passed to a subroutine ( 708 ) for displaying a warning message on display panel 20 and generating an audio alarm tone . control is next passed to a subroutine ( 710 ) which displays a menu command for requiring the user to confirm that the deflation or depressurization of cuff 4 below the level is intended while cuff 6 is deflated or pressurized to the low level . the safety interlock subroutine continues by testing whether depressurization of cuff 6 to a potentially unsafe low pressure has been initiated by the user ( 712 ), either by selecting a menu command for the deflation of cuff 6 and activating switch 22 , or by selecting the cuff 6 reference pressure and adjusting it to a pressure below a level representing the minimum pressure which will stop blood flow and the release of anesthetic agent past cuff 6 ; if so , the state of cuff 4 is then tested ( 714 ) and if cuff 4 is deflated or pressurized below a level representing the minimum pressure which will stop blood flow and the release of anesthetic agent past cuff 4 , a safety interlock signal is generated ( 716 ) which prevents the initiated deflation of cuff 6 or initiated cuff 6 reference pressure adjustment from occurring in the absence of user confirmation ; otherwise the safety interlock signal is not produced and cuff 6 deflation or reference pressure adjustment proceeds ( 718 ). after producing a safety interlock signal ( 716 ) control is passed to a subroutine ( 720 ) for displaying a warning message on display panel 20 and generating an audio alarm tone . control is next passed to a subroutine ( 722 ) which displays a menu command for requiring the user to confirm that the deflation or depressurization of cuff 6 below the level is intended while cuff 4 is deflated or pressurized to the low level . as shown in fig7 the safety interlock subroutine continues by testing ( 724 ) whether a menu command for confirming the potentially unsafe deflation or depressurization of cuff 4 is currently displayed on display panel 20 . if the menu command has been displayed for greater than 5 seconds ( 726 ), control is passed to a subroutine ( 728 ) for removing from display panel 20 and thereby making unavailable to the user the menu command for confirming the deflation or depressurization of cuff 4 . if the menu command for confirming the deflation or depressurization of cuff 4 is displayed , and is selected by the user and switch 22 is activated ( 730 ), control is passed to a subroutine ( 732 ) for producing a confirmation signal which will permit the initiated deflation or depressurization of cuff 4 to proceed . the safety interlock subroutine continues by testing ( 734 ) whether a menu command for confirming the potentially unsafe deflation or depressurization of cuff 6 is currently displayed on display panel 20 . if the menu command has been displayed for greater than 5 seconds ( 736 ), control is passed to a subroutine ( 738 ) for removing from display panel 20 and thereby making unavailable to the user the menu command for confirming the deflation or depressurization of cuff 6 . if the menu command for confirming the deflation or depressurization of cuff 6 is displayed , and is selec d by the user and switch 22 is activated ( 740 ), control is passed to a subroutine ( 742 ) for producing a confirmation signal which will permit the initiated deflation or depressurization of cuff 6 to proceed . control is then returned to the main program depicted in fig6 . referring to the flowchart depicted in fig6 it can be seen that if the operating mode signal is set to &# 34 ; single cuff mode &# 34 ;, only the controls and parameters referring to cuff 4 will be displayed and available to the user . as can be seen in fig6 after completion of specific operations related to the specific level of the operating mode signal , control then passes to a &# 34 ; process user input &# 34 ; subroutine ( 616 ) for processing user input , and this subroutine communicates with the subroutine &# 34 ; read selector &# 34 ; via global variables to update the currently displayed menu commands and parameters in response to the rotation and activation of switch 22 . this subroutine may also pass control to other subroutines or parts of the main program based on menu commands selected by the user . upon completion , this subroutine returns control to the main program . as indicated in fig6 if the user has initiated an event ( 618 ) by inflating a cuff , deflating a cuff , adjusting the level of a cuff reference pressure signal , adjusting the level of cuff inflation time limit signal , adjusting the level of the operating mode signal or silence an audio alarm ; control is next passed to a subroutine ( 620 ) which records the event in event register 58 . an event is recorded by communicating to event register 58 : the time of the event as read from real time clock 52 ; a value identifying which one of a specified set of events occurred ; and the values at the time of the event of the following parameters : operating mode signal , cuff 4 pressure signal ; cuff 4 pressure reference signal ; cuff 4 inflation time , cuff 4 inflation time limit ; cuff 6 pressure signal ; cuff 6 pressure reference signal ; cuff 6 inflation time , cuff 6 inflation time limit ; and recommended cuff pressure , when the event occurred . control is then returned to the main program . as shown in fig6 control in the main program loop is next passed to subroutine ( 622 ) which tests for alarm conditions . if an alarm condition is present ( 624 ), such as cuff over - pressurization , cuff under - pressurization , or exceeding an inflation time limit , control is passed to a subroutine ( 626 ) which initiates the generation of an alarm tone and displays on display panel 20 pre - assigned text messages indicating the cuff to which the alarm refers and the actual alarm condition present . control is next passed to a subroutine ( 628 ) which records the alarm event in event register 58 . an alarm event is recorded by communicating to event register 58 : the time of the event as read from real time clock 52 ; a value identifying which one of a specified set of alarm events occurred ; and the values at the time of the event of the following parameters : operating mode signal , cuff 4 pressure signal ; cuff 4 pressure reference signal ; cuff 4 inflation time , cuff 4 inflation time limit ; cuff 6 pressure signal ; cuff 6 pressure reference signal ; cuff 6 inflation time , cuff 6 inflation time limit ; and recommended cuff pressure , when the event occurred . control is then returned to the main program . if alarms conditions are not present at the completion of the test for alarm conditions , control is passed to a subroutine ( 630 ) for clearing any previously displayed alarm messages and deactivating , if active , the audio alarm . control is then returned to the main program . if the user has , by means of selecting the appropriate menu command , enabled the printing of events ( 632 ), then control is next transferred to a subroutine ( 634 ) to format and send registered events to the printer . this subroutine retrieves events from the event register 58 , formats the retained event information as an ascii text string suitable for printing on event register printer 62 and signals the subroutine &# 34 ; read selector &# 34 ; which sends characters to the printer that a string is available be printed . control is then returned to the main program . also as indicated in fig6 if the user has initiated a determination of recommended cuff pressure for cuff 4 or cuff 6 if alternatively selected by the user ( 634 ), control is passed to a subroutine for doing so . this subroutine ( 636 ) controls the sequencing of cuff inflation and deflation and performs the activities related to determining a recommended a cuff pressure as follows . if the user has selected a determination for cuff 4 , the blood flow signal from sensor 10 is first analyzed and shown on display panel 20 . the value of the cuff pressure reference signal for cuff 4 is then set to 50 mmhg which causes the pressure in cuff 4 to increase to 50 mmhg . next , the level of the blood flow signal being produced by sensor 10 is stored . the cuff 4 pressure reference signal is then increased up from 50 mmhg in discrete steps of 10 mmhg or 5 mmhg as follows . if the level of the current blood flow signal from sensor 10 is greater than or equal to 50 percent of the previously stored blood flow signal level , the cuff 4 pressure reference signal is increased in steps of 10 mmhg . if the level of the current blood flow signal from sensor 10 is less than 50 percent of the previously stored blood flow signal , the cuff 4 pressure reference signal is increased in steps of 5 mmhg . the pressure reference signal for cuff 4 , and thereby the pressure in cuff 4 continue to be increased until the pressure reference signal for cuff 4 exceeds 300 mmhg or the level of the current blood flow signal from sensor 10 is less than 3 percent of the previously stored blood flow signal level . if the cuff 4 reference level exceeds 300 mmhg the determination of a recommended cuff pressure is terminated and the user of instrument 2 informed by messages displayed on display panel 20 that the determination was unsuccessful . the level of the pressure signal from cuff 4 corresponding to the lowest level at which the level of the current blood flow signal from sensor 10 is less than 3 percent of the previously stored blood flow signal level is considered to represent the &# 34 ; limb occlusion pressure &# 34 ; and is used to calculate the recommended cuff pressure , as follows . if the limb occlusion pressure is less than or equal to 130 mmhg a safety margin of 40 mmhg is added to estimate the recommended cuff pressure ; if the limb occlusion pressure is greater than 130 mmhg and no grater than 190 mmhg , a safety margin of 60 mmhg is added to estimate the recommended cuff pressure ; and if the limb occlusion pressure is greater than 190 mmhg , a safety margin of 80 mmhg is added to estimate the recommended cuff pressure . this recommended cuff pressure level is displayed on display panel 20 and the cuff pressure reference signal is adjusted by microprocessor 28 to be equivalent to the level of the recommended cuff pressure . alternatively , if the user has initiated a determination of recommended cuff pressure for cuff 6 , the subroutine performs the same steps as described above for cuff 4 except the cuff 6 pressure reference and cuff 6 pressure signals are used . control is next passed to a subroutine ( 638 ) which records in event register 58 the results of the determination . a recommend cuff pressure event is recorded by communicating to event register 58 : the time of the event as read from real time clock 52 ; a value identifying which one of a specified set of events occurred ; and the values at the time of the event of the following parameters : operating mode signal , cuff 4 pressure signal ; cuff 4 pressure reference signal ; cuff 4 inflation time , cuff 4 inflation time limit ; cuff 6 pressure signal ; cuff 6 pressure reference signal ; cuff 6 inflation time , cuff 6 inflation time limit ; and recommended cuff pressure , when the event occurred . control is then returned to the main program . as depicted in fig6 the software includes provision for the user to delete all entries from event register 58 . this might be desired by the user , for example , at the completion a surgical procedure . if the user has selected the appropriate menu command ( 640 ), control is passed to a subroutine ( 642 ) which deletes all entries in the event register . control is then returned to the main program . the main program shown in fig6 continues by looping through the steps described above until such time as electrical power required for the operation of the preferred embodiment is removed or an error in program execution is detected and the program is halted by microprocessor 28 . the flow chart depicted in fig8 refers to the subroutine &# 34 ; read selector &# 34 ;. this subroutine is initiated by the software timer interrupt system of microprocessor 28 and runs asynchronously with the main program . the subroutine communicates with the main program through global variables . upon entry , the subroutine schedules itself to run again in one millisecond ( 800 ). if an ascii text string describing a registered event is to be printed ( 802 ), the status of event register printer 62 is polled and , if event register printer 62 is ready ( 804 ), a character is sent to event register printer 62 ( 806 ). as next shown in fig8 the status of the push - button of switch 22 is then polled to see if it is depressed ( 808 ): if it is , this communicated to the main program ( 810 ). the current position of the selector portion of switch 22 is then polled ( 812 ) and , if the position of the selector has changed since the last time it was polled by this routine ( 814 ), the direction ( clockwise or counter clockwise rotation ) and amount of change in position is communicated to the main program ( 816 ). the subroutine then terminates , and restarts again one milliseconds after its last initiation . the flow chart depicted in fig9 refers to the subroutine &# 34 ; regulate &# 34 ;. this subroutine controls the pneumatic system ( pump 40 , valve assemblies 26 and 38 ) and pre - processes input from sensor 10 . this subroutine is also initiated by the software timer interrupt system of microprocessor 28 and runs asynchronously with the main program . the subroutine communicates with the main program through global variables . as shown in detail in fig9 upon entry , subroutine &# 34 ; regulate &# 34 ; schedules itself to run again in 30 ms ( 900 ). next ( 902 ), the level of the pressure signal from pressure transducer 46 is read to indicate the pressure in reservoir 34 and compared to a reservoir reference pressure level which is set at 100 mmhg above the greater of the cuff 4 and cuff 6 reference pressure levels ; if the pressure in the reservoir is remains under the reference level by more than 20 mmhg for 300 ms , pump 40 is activated . if the pressure in the reservoir remains above the reference level by 20 mmhg for 300 ms , pump 40 is deactivated . also in subroutine &# 34 ; regulate &# 34 ; shown in fig9 ( 904 ) the level of the pressure signal from pressure transducer 24 is read to indicate the pressure in cuff 4 . this pressure is subtracted from the reference pressure for cuff 4 , and the magnitude and polarity of the resulting difference signal is used to control the selection and opening times of valves within valve assembly 26 , thereby regulating the pressure in cuff 4 at the reference level within ± 1 mmhg . for example , if the pressure in cuff 4 is lower than the reference pressure for cuff 4 , microprocessor 28 opens low flow valve 1002 to introduce a controlled flow of gas into cuff 4 until the pressure in cuff 4 is within ± 1 mmhg of the reference pressure . similarly , excess pressure in cuff 14 would be exhausted by opening low flow valve 1006 until the pressure in cuff 4 is within the desired pressure range , as indicated by a pressure signal from transducer 24 . the low flow valves 1002 , 1006 permit more precise and controlled alteration of the pressure in cuff 4 than is permitted by higher flow valve 1004 , 1010 . also ( 906 ), the level of the pressure signal from pressure transducer 36 is read to indicate the pressure in cuff 6 , if pressurized . this pressure is subtracted from the reference pressure for cuff 6 , and the magnitude and polarity of the resulting difference signal is used to control the selection and opening times of valves within valve assembly 38 , thereby regulating the pressure in cuff 6 at the reference level within ± 1 mmhg . finally in subroutine &# 34 ; regulate &# 34 ;, if a determination of recommended cuff pressure is in progress ( 908 ), the level of the blood flow signal from sensor 10 is read and processed ( 910 ). the amplitude of this blood flow signal is determined and communicated to the main program . it is to be understood that the invention is not to be limited to the details herein given but may be modified within the scope of the appended claims .
a configuration register is incorporated into an electrically powered tourniquet apparatus for enabling an operator to change the values of parameters initially employed at the time of the next use of the apparatus , such as the initial pressure settings and elapsed time limits . these changed initial values of parameters are stored in memory and remain there despite inadvertent or intentional interruption of electrical power to the apparatus . an event register provides capability for recording the occurrence of events and for relating the occurrence of the events to hazards and undesirable outcomes such as nerve damage associated with tourniquet usage . a safety circuit is included to detect and respond safely to certain failures which are possible within the tourniquet apparatus .