System for automatic or semi-automatic defibrillation using redundant processing

Abstract: A method and system for automatic or semi-automatic defibrillation using redundant processing is provided. In a preferred embodiment, two microprocessors each separately analyze electrocardiogram signals from a patient in order to separately determine whether the patient should be treated. If both microprocessors determine that the patient should be treated, a treatment subsystem defibrillates the patient by delivering a defibrillation charge to the patient. In a semi-automatic embodiment, the treatment subsystem only delivers a defibrillation charge to the patient if a human operator has responded to a visual indication that the patient should be treated by manually activating the defibrillator.

Description: The invention relates generally to a system for automatically analyzing electrocardiogram (ECG) signals to determine whether to treat a patient with a defibrillator, and , more specifically, to a system for automatically analyzing ECG signals to determine whether to treat a patient with a defibrillator using redundant processing. From document US 5, 097, 830 there is already a known defibrillator having a main processor and a control processor for verifying the performance of the defibrillator and halting the application of a defibrillation pulse to a patient if a failure of system components is detected. There is provided only one treatment indicating means. This document does not show the application of two processors that determine whether a patient should be treated on the basis of the analysis of the electrocardiogram signals, wherein a subsystem decides whether an accumulated charge should be delivered only if both processors produce a treat result. Devices are presently available for automatically analyzing electrocardiogram (ECG) signals to determine whether to treat a patient with a defibrillator. See, for example, U.S. Patent Number 4, 919, 144, entitled "Defibrillator ECG Interpreter,". Such devices use monitoring electrodes connected to a patient to collect ECG signals from the patient. The device then analyzes the collected ECG signals. If the device, by its analysis, determines that the patient should be treated, the device either defibrillates the patient or it advises an operator to trigger the device to defibrillate the patient. Defibrillation is accomplished by delivering an electrical charge to the patients through defibrillation electrodes connected to the patient. (In some cases, a single set of electrodes serves as both the monitoring electrodes and the defibrillation electrodes.) Such devices use a single microprocessor executing an ECG analysis program to determine whether to treat the patient. While such devices commonly execute the analysis program multiple times in order to avoid treating the patient in response to spurious, false-positive ECG signals, failure of the single processor can cause these devices to erroneously determine that the patient should be treated and proceed to treat the patient erroneously. Failure of the single processor can also cause the devices to erroneously omit treatment of the patient. The invention provides a system for automatic or semi-automatic defibrillation using redundant processing. In a preferred embodiment, two microprocessors each separately analyze electrocardiogram signals from a patient in order to separately determine whether the patient should be treated. If both microprocessors determine that the patient should be treated, a treatment subsystem defibrillates the patient by delivering a defibrillation charge tot he patient. In a semi-automatic embodiment, the treatment subsystem only delivers a defibrillation charge to the patient if a human operator has responded to a visual indication that the patient should be treated manually activating the defibrillator. Figure 1 is a block diagram showing an overview of the components of the multiple processor device. Figure 2 is an overview state diagram showing the possible states of the MPD. Figure 3 is a flow diagram of the Analyze program A system for semi-automatic defibrillation using redundant processing is provided. In a preferred embodiment, a multiple processor device (MPD) contains at least two separate microprocessors (processors) for redundantly analyzing electrocardiogram (ECG) signals and controlling defibrillation. The processors perform separate analysis of the same ECG signals, and communicate regularly across an interprocessor communications link (link) to assure the consistency of the ongoing results of each processor's analysis. If the processors agree throughout their analysis and both reach a final treat result, the MPD concludes that the patient should be treated by delivering an electrical charge to the patient. If the analysis of the processors diverge at any point, the MPD aborts treatment, dissipating any accumulated charge by discharging it internally. Because processor analysis divergence implicates the failure of one of the processors, the MPD further disable itself pending service. Figure 1 is a block diagram showing an overview of the components of the MPD. The patient 101 generates ECG signals, which are conducted by two dual-purpose electrodes to a signal processing unit 102. The signal processing unit 102 amplifies and filters the analog signal from the electrodes. The amplified and filtered analog signal is conducted to an analog to digital converter (A/D converter) 103. When the A7D converter 103 receives a conversion strobe from a main processor 104, the A/D converter 103 converts the analog voltage from the signal processing unit 102 into a digital representation that it makes available on its data bus to both the main processor 104 and an auxiliary processor 105. The conversion strobe preferably occurs every 10 milliseconds. The A/D converter 103 may output its data in either parallel or serial format. If the data is output in serial format, a shift register (not shown) is interposed between the A/D converter 103 and the processors 104, 105 to convert serial data from the A/D converter 103 to parallel data for input to each processor. The processors 104, 105, as well as other high voltage components such as the power supply, are separated from the rest of MPD by an isolation barrier 109, designed to protect the patient from unintended dangerous voltages. Both processors 104, 105 read the digital representation from the output generated the A/D converter 103, called a sample, and incorporate it in their analyses. Throughout their analyses, the processors 104, 105 communicate via a communication link (link) to assure that they are operating correctly. The link is preferably an RS-232 line. Both processors 104, 105 periodically transmit a signal to the other processor indicating that the processor is operating properly. If either processor 104, 105 fails to receive such a signal from the other processor for a period of time exceeding a signaling threshold, the processor that did not receive a signal enters a DISABLED STATE (described below), in which the MPD cannot continue normal operation. If the analysis of the main processor 104 reaches a tentative treat result, both processors 104, 105 together trigger a charging circuit 107 in the treatment subsystem 106, causing it to begin accumulating a charge. If the processors agree throughout their analyses and both reach a final treat result, the MPD either defibrillates the patient (in the case of an automatic defibrillator) or advises an operator to manually initiate defibrillation (in the case of a semi-automatic defibrillator). In either case, both processors 104, 105, trigger a delivery circuit 108 of the treatment subsystem, causing the delivery circuit 108 to deliver the charge accumulated in the treatment subsystem 106 to the patient via the dual-purpose electrodes. Both processors 104, 105 must signal the delivery circuit for it to deliver the charge accumulated in the treatment subsystem 106 to the patient. If the analyses of the processors 104, 105 diverge at any point, either the main processor 104 or the auxiliary processor 105 triggers an internal discharge function of the treatment subsystem 106, causing it to dissipate the accumulated charge by discharging it internally. Because processor analysis divergence implicates the failure of one of the processors 104, 105, the MPD further disables itself pending service. The MPD further includes an analyze button switch (not shown) and, in the case of a semi-automatic defibrillator, a deliver button switch (not shown), which each generate a signal that is made available to both processors 104, 105 to cause the processors to trigger the delivery circuit 108. Figure 2 is an overview state diagram showing the possible states of the MPD. The possible states of the MPD are all permutations of the possible states of three constituent parts of the MPD: the main processor, the treatment subsystem, and the auxiliary processor. States 211, 221, 231, 241, and 261 represent states of the main processor. States 212, 232, 252, and 262 represent states of the treatment subsystem. States 213, 223, 233, 243, and 263 represent states of the auxiliary processor. The diagram shows that the main processor 104 begins in IDLE STATE 211, the treatment subsystem 106 begins in UNCHARGED STATE 212, and the auxiliary processor 105 begins in IDLE STATE 213. The IDLE STATE 211, 213 is designed to determine whether conditions are correct for an operator to initiate ECG analysis. In the IDLE STATE 211, the main processor 104 proceeds to STANDBY STATE 221 if it determines that (a) the MPD is connected to a patient by the correct, dual-purpose electrodes, as determined by the impedance across the inputs of the A/D converter 103 (Figure 1); (b) its own diagnostic routines (diagnostics) have succeeded; and (c) it has received from the auxiliary processor 105 a message indicating that the auxiliary processor's diagnostics have succeeded. If the impedance across the A/D converter 103 inputs does not indicate that the MPD is connected to a patient by the correct, dual-purpose electrodes or the main processor 104 has not received a message from the auxiliary processor 105 about the results of the auxiliary processor's diagnostics, the main processor 104 remains in the IDLE STATE 211. If, however, the main processor's diagnostics fail or the main processor 104 receives a message that the auxiliary processor's diagnostics have failed, the main processor 104 enters a DISABLED STATE (not shown). The DISABLED STATE is designed to inhibit the immediate operation of the MPD and store information about the failure in a failure log for later use in diagnosing the failure. The main processor 104 cannot exit the DISABLED STATE until the operator activates a reset function of the MPD. Similarly, in the IDLE STATE 213, the auxiliary processor 105 proceeds to STANDBY STATE 223 if it determines that (a) the MPD is connected to a patient by the correct, dual-purpose electrodes; (b) its own diagnostic routines (diagnostics) have succeeded; and (c) it has received from the main processor 104 a message indicating that the main processor's diagnostics have succeeded. If the impedance across the A/D converter 103 inputs does not indicate that the MPD is connected to a patient by the correct, dual-purpose electrodes or the auxiliary processor 105 has not received a message from the main processor about the results of the main processor's diagnostics, the auxiliary processor 105 remains in the IDLE STATE 213. If, however, the auxiliary processor's diagnostics fail or the auxiliary processor 105 receives a message that the main processor's diagnostics have failed, the auxiliary processor 105 proceeds to a DISABLED STATE (not shown) in which information about the failure is stored in the failure log. Like the main processor 104, the auxiliary processor 105 cannot exit from its DISABLED STATE until the operator activates the reset function of the MPD. The processors 104, 105 also preferably exchange status messages periodically. If one processor fails to send a status message indicating that it is functioning properly, the other processor proceeds to the DISABLED STATE. The STANDBY STATE 221, 223 is designed to wait for the operator to initiate ECG analysis by pressing an analyze button. In the STANDBY STATE 221, the main processor 104 waits for the operator to press the analyze button. When the operator presses the analyze button, the main processor 104 (a) proceeds p 14 to ANALYZE STATE 231 and (b) sends a message to the auxiliary processor 105 informing it that the analyze button has been pressed. In the STANDBY STATE 223, when the auxiliary processor 105 receives the message from the main processor 104 informing it that the analyze button has been pressed, the auxiliary processor 105 also proceeds to ANALYZE STATE 233. The operation of the main processor 104 and the auxiliary processor 105 while in the ANALYZE STATE 231, 233 is described in detail below in conjunction with Figure 3. Briefly, in the ANALYZE STATE 231, 233, each processor 104, 105 executes the same ECG analysis program repeatedly to analyze the ECG signal samples collected by the MPD from the patient. Each iteration of the analysis program analyzes a new group of samples and produces either a treat result, indicating that the patient should be treated, or a do not treat result, indicating that the patient should not be treated. Each processor counts the number of treat results and do not treat results it has reached. In the ANALYZE STATE 231, 233, when the treat result count of both of the processors 104, 105 reaches a charge threshold, which is preferably equal to one, these advance the treatment subsystem to CHARGING STATE 232, triggering the charging circuit 107 to begin accumulating a charge in the treatment subsystem. The charging of the treatment subsystem 108 by the charging circuit 107 is preferably also protected by a processor-redundant system. The operator is preferably able to use treatment voltage controls, such as an "increase voltage" button (not shown), and a "decrease voltage" button (not shown) to control the voltage to which the treatment subsystem 106 is charged. When the operator uses the treatment voltage controls to select a voltage to which the treatment subsystem 106 should be charged, the selected voltage is communicated to the main processor 104. The main processor 104 stores the selected voltage and transmits a message to the auxiliary processor 105 that indicates the selected voltage and instructs the auxiliary processor 105 to set the treatment voltage to match the selected voltage. The auxiliary processor 105 returns a message to the main processor 104 containing the selected voltage so that the main processor 104 may check that the auxiliary processor 105 received it correctly. The auxiliary processor 105 also sends an indication of the selected voltage to a D/A converter 103, which converts the digital indication of the selected voltage to an analog indication of the selected voltage. This analog indication of the selected voltage is the input to one side of a charging comparator (not shown in Figure 1) in the charging circuit 107 that regulates the accumulation of charge in the treatment subsystem 106. The input for the other side of the charging comparator is the voltage across a capacitor (not shown in Figure 1) in the treatment subsystem 106 in which charge is accumulated. When the signals from both processors 104, 105 to begin charging are received to advance the treatment subsystem 106 to the charging state, the capacitor begins to accumulate charge and the voltage across it increases. When the voltage across the comparator has increased to match the analog indication of the selected voltage, the output of the comparator changes, the charging is halted, and a charging complete signal is sent to both processors 104, 105. The voltage across the capacitor is converted to digital form by another D/A converter and is read by both processors 104, 105 in digital form to determine whether the actual capacitor voltage matches, within tolerance, the selected voltage. If not, each processor enters the DISABLED STATE, preventing the MPD from proceeding to treat the patient. Also, during charging, both processors 104, 105 preferably to check to see whether charging is taking longer than a maximum charging time. If so, the processors enter the DISABLED STATE. In the ANALYZE STATE 231 (FIGURE 2), when the main processor's treat result count reaches a treat threshold, which is preferably equal to two, it proceeds to TREAT STATE 241. Similarly, in the ANALYZE STATE 233, the auxiliary processor 105 also proceeds to TREAT STATE 243 when its treat result count reaches the treat threshold. On the other hand, if, in the ANALYZE STATE 231, the main processor's DO NOT TREAT result count reaches a DO NOT TREAT threshold, preferably equal to two, the main processor 104 proceeds to DO NOT TREAT STATE 261. The DO NOT TREAT STATE 261 is designed to prevent the treatment of the patient and dissipate any charge accumulated in the treatment subsystem 106 by discharging it internally. Similarly, if, in the ANALYZE STATE 231, the auxiliary processor's DO NOT TREAT result count reaches the DO NOT TREAT threshold, the auxiliary processor proceeds to DO NOT TREAT STATE 263. The TREAT STATE 241 is designed to treat the patient by delivering the charge accumulated in the treatment subsystem 106 if a deliver button is pressed by the operator in a semiautomatic system. In the TREAT STATE 241, if the deliver button is pressed, the main processor 104 sends a message to the auxiliary processor 105 that the deliver button has been pressed and signals the delivery circuit 108 to deliver the charge accumulated in the treatment subsystem 106 to the patient. In the TREAT STATE 243, if the deliver button is pressed and the auxiliary processor 105 receives a message from the main processor 104 that the deliver button has been pressed, the auxiliary processor 105 signals the delivery circuit 108 to deliver the charge accumulated in the treatment subsystem to the patient. In the CHARGING STATE 232, if charging is complete and both processors 104, 105 signal the treatment subsystem 106 to deliver the charge accumulated in the treatment subsystem 106 to the patient, then the treatment subsystem 106 proceeds to PATIENT DELIVERY STATE 252 and delivers the charge accumulated in the treatment subsystem to the patient. If the deliver button is not depressed within a predetermined period of time, each processor 104, 106 proceeds to the DO NOT TREAT STATE 261, 263 followed by the IDLE STATE 211, 213. When either processor 104, 105 enters the DO NOT TREAT STATE 261, 263, it advances the treatment subsystem to CHARGE DISSIPATE STATE 262. In the charge DISSIPATE STATE 262, the treatment subsystem internally discharges any charge accumulated in the CHARGING STATE 232. In an alternate embodiment, the treatment subsystem delivers any charge accumulated in the CHARGING STATE to ground. An Analyze program is executed by both processors 104, 105 in the ANALYZE STATE 231, 233 to analyze ECG samples (samples). The Analyze program analyzes samples in groups, reaching either a TREAT result or a DO NOT TREAT result for each group. The program keeps track of the number of TREAT results and DO NOT TREAT results, and continues to analyze further groups of samples until either the number of TREAT results or the number of DO NOT TREAT results reach a predetermined threshold. At this point, the program has reached a final result, analysis is complete, and the program causes the processor to proceed to either the TREAT STATE 241, 243 or the DO NOT TREAT STATE 261, 263. Figure 3 is a flow diagram of the Analyze program. In step 301, the program initializes a TREAT result counter and a DO NOT TREAT result counter by setting each equal to zero. The TREAT result counter is a variable that contains the number of treat results reached by the program, and the DO NOT TREAT result counter contains the number of DO NOT TREAT results reached by the program. In steps 302-306, the program collects and analyzes a group of samples. Step 302 marks the beginning of a loop for collecting each sample of the group, and contains the loop boundaries. The loop is repeated for each value of sample between 1 and the size of a sample group, which is preferably equal to 300. In step 303, the program strobes the A/D converter 103 to produce a new sample. Step 303 is preferably only executed by the main processor 104, as it alone is responsible for strobing the A/D converter 103. In step 304, the program stores the new sample for later analysis. Step 305 marks the end of the loop. In step 306, the program analyzes the group of samples collected and stored in steps 302-305. After analyzing the loop, the program continues through connector A to step 307. In step 307, if the result of the analysis is the TREAT result, then the program continues at step 310, else the program continues at 308. In step 308, the program increments the DO NOT TREAT result counter to reflect the DO NOT TREAT result reached in analyzing the group of samples. In step 309, if the DO NOT TREAT result counter equals the DO NOT TREAT threshold, preferably equal to two, then the program concludes and the processor 104, 105 enters the DO NOT TREAT STATE 261, 263, else the program continues through connector B at step 302 to analyze another group of samples. If the program determined at step 307 that treatment is indicated, it increments the TREAT result counter at step 310 to reflect the treat result reached in analyzing the group of samples. In step 311, if the TREAT result counter is equal to the charge threshold, preferably equal to one, then the program continues at step 312, else the program continues at step 313. In step 312, the program causes the treatment subsystem 108 to enter the CHARGING STATE 232 by triggering the charging circuit. In the auxiliary processor, step 312 involves sending an enable signal to the charging circuit, allowing it to be triggered by the main processor. In the main processor 104, step 312 involves triggering the charging circuit once it has been enabled by the auxiliary processor 105. The program then continues through connector B at step 302 to analyze another group of samples. In step 313, if the treat result counter equals the treat threshold, then the program concludes and the processor 104, 105 enters the TREAT STATE 241, 243, else the program continues through connector B at step 302 to analyze another group of samples. While this invention has been shown and described with reference to preferred embodiments, it will be understood by those skilled in the art that various changes or modifications in form and detail may be made without departing from the scope of the invention as defined in the appended claims. For example, the MPD could contain three or more processors for redundantly analyzing ECG signals and controlling defibrillation. Also, to further automate the operation of the MPD, the analyze button pressed condition for proceeding to the ANALYZE STATE may be omitted, as may the deliver button pressed condition for proceeding to the PATIENT DELIVERY STATE.

Claims: A dual processor semi automatic defibrillator, comprising: a first processor (104) for analyzing electrocardiogram signals from a patient and producing either a treat result if the analysis shows that the patient should be treated or a do not treat result if the analysis shows that the patient should not be treated; a second processor (105) for analyzing the same electrocardiogram signals analyzed by the first processor (105) and producing either a treat result if the analysis shows that the patient should be treated or a do not treat result if the analysis shows that the patient should not be treated; and a treatment subsystem (106) for defibrillating the patient if and only if both the first processor and the second processor produce a treat result. The defibrillator of claim 1, further comprising: a communications link connecting the first processor (104) and the second processor (105); in the first processor (104), an operations monitor for periodically determining whether the first processor is operating correctly, and if so, transmitting a signal to the second processor (105) via the communications link indicating that the first processor (104) is operating correctly; and in the second processor (105), a signaling monitor for receiving from the first processor via the communications link signals indicating that the first processor (104) is operating correctly, comprising: a signal reception timer for determining whether an interval greater than a predetermined signaling interval has elapsed since the last signal indicating the first processor (104) is operating correctly was received from the first processor via the communications link, and a defibrillation terminator that terminates the defibrillation activities of the defibrillator. The defibrillator of claim 2, further comprising: a capacitor from which a defibrillation charge is delivered to the patient by the treatment subsystem; and a charging actuator connected to the capacitor and both microprocessor which charges the capacitor to the desired energy level if and only if charging actuation signals are received from each processor. The defibrillator of claim 3, further comprising a charging energy control system, comprising: a desired energy indication receiver for receiving indication of the desired energy to which the capacitor should be charged when charging is actuated by the charging actuator; a charging complete indication transmitter for transmitting an indication to at least one of the processor that the capacitor has been completely charged to the desired energy; and an actual charged energy indication transmitter for transmitting to at least one of the microprocessors an indication of actual energy accumulated in the capacitor. The defibrillator of claim 1, wherein the treatment subsystem (106) comprises: a charging circuit (107) for accumulating a defibrillation charge; a patient delivery (108) circuit for delivering the defibrillation charge to the patient if and only if both the first processor and the second processor produce a treat result; and an internal discharge circuit for dissipating the defibrillation charge if either the first processor or the second processor produce a do not treat result. The defibrillator of claim 5, further comprising: dual-purpose electrodes connected to the first processor (104), the second processor (105) and the patient delivery circuit at a first end and adapted to be connected to the patient at a second end for both conveying electrocardiogram signals from the patient to the first processor and the second processor and delivering the defibrillation charge from the patient delivery circuit to the patient; and an impedance fail-safe subsystem for determining whether the impedance across the dual-purpose electrodes is within an acceptable range for the combine impedance of typical du al-purpose electrodes and a typical patient and, if not, preventing the delivery of the defibrillation charge to the patient. The defibrillator of claim 5, further comprising: in the first processor (104), a first charging initiator for initiating the accumulation of charge in the charging circuit; in the second processor (105), a second charging initiator for initiating the accumulation of charge in the charging circuit; and a charging controller for causing the charging circuit to begin accumulating a defibrillation charge if and only if both the first charging initiator and the second charging initiator initiate the accumulation of charge in the charging circuit. The defibrillator of claim 1, further comprising a treatment actuator for use by an operator to actuate defibrillation by the treatment subsystem, and wherein the treatment subsystem defibrillates the patient if and only if the operator actuates the treatment actuator. The defibrillator of claim 1, further including signal processor for processing the electrocardiogram signals into a form in which the first processor and the second processor may analyze them. A defibrillator according to claim 1 further comprising: an analog-to-digital converter (103) for receiving and converting to digital form electrocardiogram signals from a patient; said first and second processors (104, 105) analyze said electrocardiogram signals converted to digital form by the analog-to-digital converter. The defibrillator of claim 10, further including a clock for strobing the analog-to-digital converter to convert to digital form the ECG signal presently being received from the patient. The defibrillator of claim 5, wherein the first processor (104) contains a charging initiator for causing the charging circuit to begin accumulating a defibrillation charge. The defibrillator of claim 10, further including: a communications link between the first processor and the second processor (104, 105) for transmitting status information between the first processor and the second processor to determine if the analysis of the first processor and the analysis of the second processor are proceeding properly; and a defibrillator disabler for disabling the defibrillator if it is determined that the analysis of the first processor or the analysis of the second processor is not proceeding properly.

Inventors: CAMPBELL DEAN D, WILEY ROBERT A, CAMPBELL, DEAN D., WILEY, ROBERT A.
Applicants: PHYSIO CONTROL CORP, PHYSIO-CONTROL CORPORATION
Application year: 1995
Main classification: A61N1
IPC codes: A61B5, A61N1, G06F17