JPH09234227A - Medical device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the control accuracy or fault tolerance of a medical device. SOLUTION: This device is provided with a first microcomputer 16 which receives signals from medical sensors 11 to 15, executes certain programs, and sends the first output, a second microcomputer 17 which receives signals from the medical sensors at the same time as for the first microcomputer, executes certain programs, and sends the second output, and a monitor/control section 18 which compares the first and second outputs and generates an alarm signal when the difference between them are out of a specification. Outputs of the first and second microcomputers are written into the corresponding areas of a multi-port shared memory 19, they are compared, and each informs a watchdog 18 of the other party's failure to generate an alarm.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a medical device using a dual processor system to improve medical control accuracy.

[0002]

2. Description of the Related Art Incubators are used to protect and raise premature babies in an optimal environment in which they are shielded from the outside air. A conventional incubator includes, for example, a nursery room which is formed on a movable body by casters and accommodates a premature baby such as a premature baby.

In this nursery room, the temperature, humidity and oxygen concentration of the space containing the premature baby on the bed are controlled, and the space is covered with a transparent hood so that the condition of the premature baby can be monitored from the outside. ing.

Therefore, inside the main body, an air conditioner for adjusting the temperature and humidity of the air circulated through the nursery room and an air conditioner based on signals from a medical sensor for measuring the temperature and humidity are provided. And a control circuit for controlling the.

This control circuit includes, for example, Japanese Patent Publication No. 7-49.
As shown in No. 055, one microcomputer and a watchdog timer which sends a reset signal to the microcomputer when there is no monitor signal periodically sent from this microcomputer are used.

[0006]

Therefore, the control circuit which can be used in the conventional incubator can detect the failure of the microcomputer and its peripheral equipment by using one microcomputer and the watchdog circuit.

Program runaway by one microcomputer may be detected by a watchdog circuit.
However, an error in data input, and an output and air-conditioning control based on incorrect data cannot be completely prevented, and therefore the control accuracy of medical equipment such as an incubator may be significantly impaired.

In view of the above circumstances, an object of the present invention is to provide a highly reliable medical device by significantly increasing the control accuracy of the medical device such as an incubator using a dual processor system.

[0009]

A medical device according to the present invention comprises a first microcomputer to which a signal from a medical sensor is input and which executes a predetermined program to obtain a first output; and the medical sensor. Signals are simultaneously input, the second microcomputer that executes the predetermined program to obtain the second output and the first and second outputs are compared, and an alarm signal is generated when it is out of the allowable range. And a monitoring / control unit for obtaining the same.

When the difference between the first output and the second output is out of the allowable range, the monitoring / control unit causes the first and second microcomputers to execute the self-diagnosis program, and based on these output results. Generates an alarm signal. The monitor / control unit is a watchdog timer that sends a reset signal to the microcomputer when there is no monitor signal that is periodically sent from the microcomputer.

Further, the medical sensor is made up of a plurality of types, each signal is inputted to the first and second microcomputers through the multiplexer, and the predetermined program is stored in a plurality of sets of shared memory corresponding to the medical sensor. Remembered.

[0012]

DETAILED DESCRIPTION OF THE INVENTION An embodiment of the present invention will be described below with reference to FIG. FIG. 1 is a schematic diagram of a control circuit incorporated in, for example, an incubator.

This control circuit includes various medical sensors, for example, an internal temperature display sensor 11 provided in a nursery room,
Sensor 12 for controlling the temperature inside the nursery room used for controlling the temperature in the nursery room, oxygen sensor 13 for measuring the oxygen concentration of oxygen and air mixed gas circulating in the nursery room, and humidity sensor for measuring the humidity in the nursery room 14 and a humidifying tank temperature sensor 15 that indirectly measures the water temperature of the humidifying tank in which warm water for humidifying the nursery room is stored.

Each of these medical sensors 11 to 15 includes a preamplifier (not shown) which is connected to a corresponding measuring element and amplifies an analog amount in a measurement range to an analog amount having a constant width. The amplification factor and offset value of the on-amplifier are adjusted in advance. Therefore, the outputs of the medical sensors 11 to 15 are respectively connected to the five input terminals of the 8-channel A / D converters of the first and second microcomputers 16 and 17.

First, the first microcomputer 16 is, for example, a Hitachi H8 / 532 one-chip microcomputer.
It includes a channel A / D converter, a 2-channel D / A converter, an interrupt timer that can generate a software interrupt, a RAM for a work area, and a ROM for storing a program.

The first microcomputer 16 periodically sends an interval monitoring signal C1 which is not output when various predetermined programs run out of control, to the monitoring / control unit, that is, the watchdog timer 18, to improve safety and reliability. .

That is, when the interrupt timer has generated a software interrupt after a predetermined period of time, the monitoring signal C1 is output if the program being executed is normal, or if the program being executed is running out of control. If a failure has occurred in the first microcomputer 16, the monitoring signal C1 is output. Therefore, the value set in the interrupt timer is made substantially the same as that of the watchdog timer in consideration of the number of clocks executed at the time of software interrupt.

Therefore, the monitoring / control unit 18 is operated when the power switch is turned on or when the reset button (not shown) is pressed.
The reset signal RES is transmitted to the first microcomputer 16. Next, when the CPU, peripheral functions and programs in the first microcomputer 16 are normal, the interval monitoring signal C1 sent at a constant cycle is compared with the watchdog timer, and when it is within the allowable range, that is, within the window period. When the monitor signal is received, the first microcomputer 16 is determined to be normal,
Work is continuing.

When the monitoring signal C1 is not received during the window period set by the watchdog timer, the monitoring / control unit 18 determines that the first microcomputer 16 is abnormal and shifts the system to the alarm state, and outputs the alarm sound. Is generated, the red LED indicating the abnormality is emitted, and the humidifying tank and the heater are shut off.

On the other hand, the second microcomputer 17 is the first microcomputer 1
Like H.6, it consists of Hitachi's H8 / 532 one-chip microcomputer, and has the same various peripheral functions.

The second microcomputer 17 periodically sends an interval monitoring signal C2, which is not output when various predetermined programs run out of control, to a monitoring / control unit, that is, a watchdog timer, to improve safety and reliability. Also,
The setting value of the interrupt timer in the second microcomputer 17 is the first
It is the same as that of the microcomputer 16.

Therefore, the monitor / control unit 18 sends the reset signal RES to the second microcomputer 17, and the interval monitor sent at a constant cycle when the CPU, peripheral functions and programs in the second microcomputer 17 are normal. Signal C1
Is compared with the watchdog timer, the second microcomputer 17 is determined to be normal when it is within the allowable range, and the second microcomputer 17 is determined to be abnormal when it is outside the allowable range.

FIG. 2 is a flow chart of a subroutine for the first microcomputer 16 to read and output data from the medical sensor, for example, the internal temperature display sensor 11. In step 31, the value from the internal temperature display sensor 11 is read into the first microcomputer 16, and the output value is written into the first area (RAM01 address) of the multiport shared memory 19.

As the shared memory 19, for example, 7130 manufactured by IDT is used, and two sets of data, address and control buses are respectively connected to corresponding data, address and control buses of the first and second microcomputers. . Further, the read value may be calculated as a predetermined coefficient or variable after A / D conversion, and the calculation result, that is, the first output may be written in the first area.

Further, data at the same time from the same internal temperature display sensor 11 is read into the second microcomputer 17, and the output value thereof is stored in the second area (RAM) of the multiport shared memory 19.
Address 11). The read value may be A / D-converted and then operated with the same predetermined coefficient or variable as above, and the operation result, that is, the second output may be stored in the second area of the shared memory 19.

The first microcomputer 16 is considered to be stored in the second area of the shared memory 19 several tens of clocks after the first output is stored in the first area of the shared memory 19 in step 32. Contents of RAM11, that is, second
Read the output. Next, in step 33, RAM01
And the contents of the RAM 11 are compared.

If the difference between the contents of RAM01 and the contents of RAM11 is within the allowable range, the value of the loop counter is set to X in step 34, and this subroutine is finished. Therefore, the second microcomputer 17 is regarded as normal.

The first microcomputer 16 executes step 33.
If the result of comparison in step 3 is outside the allowable range, step 35.
Decrement the loop counter in step 3
At 6, it is determined whether the value of the loop counter is zero. If it is not zero, step 31 is executed again to repeat the data reading operation.

If the determination in step 36 is zero, in step 37 the interval monitoring signal C1
Is masked, control is passed to the watchdog timer, and the subroutine ends.

This watchdog timer, for example, reads a flag set at one port of the second microcomputer 17, considers the second microcomputer 17 to be abnormal, and sends an alarm signal to the alarm sound generating means 38 to issue a single alarm sound. Generated intermittently or intermittently. This alarm signal is also sent to the alarm display means 39 to blink or light the light emitting element to display the abnormality of the second microcomputer 17.

Furthermore, the first microcomputer 16 sends an interrupt signal for causing the second microcomputer 17 to execute the self-diagnosis program to the second microcomputer 17 before the alarm signal is generated, and the self-diagnosis program is executed. The presence or absence of the alarm signal may be determined based on the result.

Although the case where the first microcomputer 16 detects the abnormality of the second microcomputer 17 has been described above, the first microcomputer 16 can also detect the abnormality by the second microcomputer 17 in the same manner.

FIG. 3 is a flowchart of another subroutine in which the second microcomputer 17 reads and outputs the data from the internal temperature display sensor 11. Step 4
In 1, the value from the internal temperature display sensor 11 is read by the second microcomputer 17, and the output value is written in the second area (RAM 11 address) of the multiport shared memory 19. For example, the read value may be calculated as a predetermined coefficient or variable after A / D conversion, and the calculation result, that is, the second output may be written in the second area.

Further, the data at the same time from the same internal temperature display sensor 11 is read into the first microcomputer 16 and the output value thereof is stored in the first area (RAM) of the multiport shared memory 19.
Address 01). For example, the read value is A
After the / D conversion, it may be operated with the same predetermined coefficient or variable as above, and the operation result, that is, the second output may be stored in the second area of the shared memory 19.

It is considered that the second microcomputer 17 is stored in the first area of the shared memory 19 several tens of clocks after the first output is stored in the second area of the shared memory 19 in step 42. Contents of RAM 01, that is, first
Read the output. Next, in step 43, the RAM 11
And the contents of RAM01 are compared.

If the difference between the contents of the RAM 11 and the contents of the RAM 01 is within the allowable range, the value of the loop counter is set to X in step 44, and this subroutine is finished. Therefore, the first microcomputer 16 is regarded as normal.

The second microcomputer 17 also proceeds to step 43.
If the comparison result in step S4 is outside the allowable range, step 45
Decrement the loop counter in step 4
At 6, it is determined whether the value of the loop counter is zero. If it is not zero, step 41 is executed again and the data read operation is repeated.

If the determination in step 46 is zero, in step 47 the interval monitoring signal C2
Is masked, control is passed to the watchdog timer, and the subroutine ends.

The watchdog timer, for example, reads a flag set at one port of the second microcomputer 17, regards the first microcomputer 16 as an abnormality, sends an alarm signal to the alarm sound generating means 38, and issues a single alarm sound. Generated intermittently or intermittently. This alarm signal is also sent to the alarm display means 39 to blink or light the light emitting element, for example, to indicate the abnormality of the first microcomputer 16.

Further, the second microcomputer 17 sends an interrupt signal for causing the first microcomputer 16 to execute the self-diagnosis program before the alarm signal is generated, to execute the self-diagnosis program. The presence or absence of the alarm signal may be determined based on the result.

Further, the time at which each microcomputer outputs the calculation result may be slightly shifted even if the program start times are made coincident. Therefore, several tens of clocks after being stored in a predetermined area of the shared memory 19 are appropriately set. Is set.

The above-mentioned subroutine is executed for the internal temperature display sensor 11, but it goes without saying that the same subroutine can be constructed for the other medical sensors 12 to 15. Therefore, the shared memory 19 is assigned with output areas to be written corresponding to the other medical sensors 12 to 15, respectively.

[0043]

As described above, according to the present invention, in the first and second microcomputers 16 and 17, the code of the program executed by any one of the microcomputers has any bit due to external noise or the like. Even if it flips over and the program runs out of control,
The watchdog timer can easily detect the non-input of the monitoring signal that should be sent periodically and issue an alarm.

Next, even when the monitoring signal is periodically sent from each microcomputer to the watchdog 18, the first microcomputer 16 monitors the operation or calculation of the second microcomputer 17, and the second microcomputer 17 detects Since the operations of one microcomputer 16 are monitored with each other, it is possible to enhance the control accuracy or fault tolerance of the system and provide a highly reliable medical device.

[Brief description of drawings]

FIG. 1 is a schematic block diagram of a control circuit of an incubator according to an embodiment of the present invention.

FIG. 2 is a flowchart of a subroutine for reading and outputting data from an internal temperature display sensor in the first microcomputer 16.

FIG. 3 is a flowchart of another subroutine in which the second microcomputer 17 reads and outputs data from the internal temperature display sensor.

[Explanation of symbols]

 11-15 Medical Sensor 16 Microcomputer 17 Second Microcomputer 18 Monitoring / Control Unit 19 Shared Memory

Claims (3)

[Claims] 1. A first microcomputer that receives a signal from a medical sensor and executes a predetermined program to obtain a first output; and a signal from the medical sensor that is input at the same time to the predetermined microcomputer. A medical device including a second microcomputer that executes a program to obtain a second output, and a monitor / control unit that can generate an alarm signal when the first and second outputs are compared and out of an allowable range. . 2. The monitor / control unit causes the first and second microcomputers to execute respective self-diagnosis programs when the difference between the first and second outputs is out of an allowable range, and outputs these output results. The medical device according to claim 1, wherein the alarm signal is generated based on 3. The medical sensor comprises a plurality of types, each signal is input to the first and second microcomputers via a multiplexer, and the predetermined program corresponds to the medical sensor in a plurality of sets. The medical device according to claim 1, wherein the medical device is stored in a shared memory.