Patent Description:
IVS laboratory systems are known which comprise laboratory devices configured to conduct pre-analysis, analysis, and post-analysis with respect to sample containers receiving a sample to be processed in the laboratory system. Safety mechanisms for operator safety are regularly provided.

For example, document <CIT> relates to an automated device for loading a centrifuge where tubes are presented to the centrifuge via an automated routing system. Safety doors are provided to prevent an operator from reaching into the station. Document <CIT> discloses integrated robotic sample transfer devices and components which are used for transferring small samples of material from one registered position to another registered position.

In document <CIT>, a laboratory device for handling sample tubes in the context of storing such sample tubes in a storage compartment as well as an automated tubes identification system are disclosed. Document <CIT> pertains to an automated analyzer including a conveyance mechanism to convey a specimen, an analysis portion to analyze the specimen, and a device cover to cover a movable mechanism including the conveyance mechanism. The automated analyzer is provided with an interlock mechanism and an interlock release mechanism.

Document <CIT> relates to an automatic analyzer for analyzing component quantities contained in samples such as blood and urine and to an interlock mechanism for performing opening and closing control of a device cover.

The user manual for "<NPL>, discloses instructions for use of a hematology specimen processing module with system manager. The module has a housing, an actuator, and a cover. When the system massage "Cover Opened' occurs, the SPM (specimen processing module) immediately stops operation.

Document <CIT> relates to systems and methods for refrigerated storage of controls and calibrators that utilize a refrigerant storage assembly having an insulated housing and door assembly, thermoelectric coolers, and the refrigerated base assembly having a metal plate thermally coupled to coolers, one or more sensors, and a plurality of receptacles to receive fluid tubes. Refrigerated storage provides a refrigerated environment suitable for multi-day storage of control and calibrator fluids.

It is an object of the present disclosure to provide a method for operating an IVD laboratory system as well as an IVD laboratory system with improved safety.

For solving the problem, a method for operating an IVD laboratory system according to independent claim <NUM> is provided. Further, an IVD laboratory system according to independent claim <NUM> is provided. Further embodiments are disclosed in dependent claims.

According to one aspect, a method for operating an IVD laboratory system is provided. The IVD laboratory system has a housing with an opening; an actuator device, which is arranged in the housing, for processing sample containers; a cover configured to cover the opening; a cooling device configured to cool the sample containers; and a cooling device control unit configured to control operation of the cooling device. The method comprises: determining whether the cover is open; determining whether the cooling device control unit is active; in a normal system mode, disabling operation of the actuator device based on at least one of the cover being open and the cooling device control unit being inactive; and, in a bypass system mode, enabling operation of the actuator device based on the cover being open and the cooling device control unit being active.

According to another aspect, an IVD laboratory system is provided, comprising: a housing with an opening; an actuator device, which is arranged in the housing, for processing sample containers; a cover configured to cover the opening; a cooling device configured to cool the sample containers; and a cooling device control unit configured to control operation of the cooling device. The system is configured to: determine whether the cover is open; determine whether the cooling device control unit is active; in a normal system mode, disable operation of the actuator device based on at least one of the cover being open and the cooling device control unit being inactive; and, in a bypass system mode, enable operation of the actuator device based on the cover being open and the cooling device control unit being active.

The method may thus comprise disabling operation of the actuator device based on the cover being open and disabling operation of the actuator device based on the cooling device control unit being inactive. The method may comprise determining whether the cover is open or closed and/or determining whether the cooling device control unit is active or inactive.

The method may further comprise, in the normal system mode, enabling operation of the actuator device based on the cover being closed and the cooling device control unit being active and/or, in the bypass system mode, disabling operation of the actuator device based on at least one of the cover being closed and the cooling device control unit being inactive.

The IVD laboratory system may comprise a locking device configured to lock the cover. The method may comprise determining whether the locking device is locked (or unlocked) and/or, in the normal system mode, disabling operation of the actuator device based on the locking device being unlocked. The method may further comprise, in the normal system mode, enabling operation of the actuator device based on the cover being closed, the locking device being locked, and the cooling device control unit being active.

The method may further comprise, in the bypass system mode, disabling operation of the actuator device based on the locking device being locked. The method may comprise, in the bypass system mode, enabling operation of the actuator device based on the cover being open, the locking device being unlocked, and the cooling device control unit being active.

Determining whether the cover is open may be carried out via a cover sensor. The cover sensor may for example be provided in the locking device. The locking device may comprise a locking device sensor configured to determine whether the locking device is locked. The locking device may comprise a solenoid lock.

The method may further comprise switching between the normal system mode and the bypass system mode by a switching device of the IVD laboratory system, preferably by user operation of the switching device of the IVD laboratory system. The switching device may be a key switch, preferably configured to receive a key for switching. The switching device may comprise a normally open output and a normally closed output.

Determining whether the cooling device control unit is active comprises repeatedly transmitting heartbeat signals to a watchdog unit of the IVD laboratory system and/or determining the cooling device control unit as inactive after the time since a last heartbeat signal has been received by the watchdog unit has exceed a timeout threshold.

The timeout threshold may be between <NUM> and <NUM>, preferably between <NUM> and <NUM>, more preferably between <NUM> and <NUM>. The watchdog unit may be provided as an integrated circuit and/or a microcontroller.

The heartbeat signals may be transmitted from the cooling device control unit, preferably with a heartbeat signal time interval between <NUM> and <NUM>, preferably between <NUM> and <NUM>, more preferably between <NUM> and <NUM>. Additionally or alternatively, the watchdog unit may transmit a probe signal to the cooling device control unit. After receipt of the probe signal, the cooling device control unit may transmit a response signal. The cooling device control unit may then be determined as inactive after the time since the probe signal has been transmitted has exceed a response timeout threshold. The response timeout threshold may be between <NUM> and <NUM>, preferably between <NUM> and <NUM>, more preferably between <NUM> and <NUM>.

The method may comprise controlling the cooling device by a second cooling device control unit (different from the cooling device control unit) in reaction to determining the cooling device control unit being inactive. The IVD laboratory system may comprise the second cooling device control unit, which is configured to control operation of the cooling device.

In particular, in reaction to determining the cooling device control unit being inactive, a reset signal may be transmitted from the watchdog unit to a latch, after which the latch preferably transmits a low state output for transfer of control to the second cooling device control unit.

The method may further comprise controlling the cooling device by the cooling device control unit with variable cooling capacity (controlling with cooling capacity adjustment) and/or controlling the cooling device by the second cooling device control unit with fixed cooling capacity.

The fixed cooling capacity may be a maximum cooling capacity of the cooling device. The fixed cooling capacity may also be fixed between <NUM> % and <NUM> % of the maximum cooling capacity of the cooling device.

The cooling device may comprise an air-cooling device, e.g., a fan or a plurality of fans. Thus, controlling the cooling device by the cooling device control unit may comprise (variably) controlling a fan speed. Controlling the cooling device by the second cooling device control unit may comprise keeping the fan(s) at a fixed fan speed, e.g., a maximum fan speed.

The method may comprise cooling the sample containers by the cooling device <NUM>, in particular by the fan or the plurality of fans.

The cooling device control unit may be software-implemented and/or the second cooling device control unit may be hardware-implemented.

For example, the cooling device control unit may comprise or be part of a data processing device (with e.g., a general purpose processor) comprising a cooling device control software (in a memory of the data processing system) for controlling operation of the cooling device. The second cooling device control unit may comprise a dedicated control circuit for controlling operation of the cooling device.

Disabling operating of the actuator device may comprise stopping the actuator device in reaction to having determined that the actuator device is at least partially moving. Disabling operating of the actuator device may also comprise stopping a sample container movement in reaction to having determined that the actuator device is moving sample containers. Disabling operating of the actuator device may comprise applying a brake device configured to stop and/or slow and/or prevent (mechanical) movement of/within the actuator device and/or movement of the sample containers.

Disabling operation of the actuator device may comprise interrupting a power supply to the actuator device. Enabling operation of the actuator device may comprise supplying power to the actuator device.

Disabling (enabling) operation of the actuator device may comprise disabling (enabling) an actuator device control unit (actuator device controller) configured to control operation of the actuator device. The actuator device control unit may comprise a plurality of actuator device control subunits, in particular, a motor driver and/or a motor controller. The actuator device control subunits may be implemented as separate integrated circuits (ICs). In particular, a first device control subunit may be motor driver IC, and the second device control subunit may be a motor (servo) controller IC. The first device control subunit and the second device control subunit may be arranged serially.

The actuator device may comprise at least one movable device (movable part), preferably at least one of a sample container transport device, a sample container distribution device, a sample container analysis device, and a motor. The actuator device may in particular comprise at least one of a stepper motor, a servo motor, a rotor, a gripper arm, a conveyor belt, and a magnetic actuator configured to magnetically move sample containers.

The actuator device may be configured to move the sample containers.

The method may comprise, in the normal state mode, disabling operation of the actuator device further based on at least one of the actuator device control unit configured to control operation of the actuator device being in a reset state, the actuator device control unit being in a freeze state, and an emergency user input device being in an active state.

The actuator device control unit may, e.g., comprise motion control chips. The emergency user input device may comprise an emergency button and/or an emergency switch. The emergency user input device may be operable by the user.

The method may comprise disabling the actuator device based on a signal fault from one of the cover, the locking device, the cooling device control unit, the actuator device control unit, and the emergency user input device.

The method may comprise bypassing a signal fault in the locking device signal in the bypass system mode, in particular not disabling the actuator device in reaction to a fault in the locking device signal in the bypass mode. The method may comprise not bypassing the signal fault in the locking device signal in the normal system mode.

The method may further comprise determining the disabling and the enabling of operation of the actuator device using a logical circuit which comprises a cover state, a cooling device control unit state (watchdog control signal for the cooling device), and a system mode state as logical inputs and an actuator device state as logical output.

The logical inputs may comprise logical states (binary states, binary-valued variables). For example, the logical state may be indicative of one of active/inactive, open/closed, activated / not activated, enabled/disabled, and true/false.

The logical inputs may comprise at least one of a controller freeze state of an actuator device control unit configured to control the actuator device, a controller reset state of the actuator device control unit, an emergency user input device state, a cooling device control unit state, a (first and/or second) cover state, a (first and/or second) locking device state, a (first and/or second) bypass state indicative of the system bypass mode, and a safety user input device state.

The logical inputs (input signals) may comprise redundant logical states, preferably for detecting faults in the respective inputting units/devices and/or the wiring (therefrom). For example, a first and a second cover state, and/or a first and a second locking device state, and/or a first and a second bypass state may be provided.

The actuator device may be disabled based on at least one of the first and the second cover state being indicative of the cover being open. The actuator device may also be disabled based on at least one of the first and the locking device state being indicative of the locking device being unlocked.

The actuator device may be disabled based on the first bypass state being different from the second bypass state. In particular, the actuator device may be disabled based on the first bypass state being indicative of a bypass and the second bypass states not being indicative of a bypass. The actuator device may further be disabled based on the first bypass state not being indicative of a bypass and the second bypass states being indicative of a bypass.

The logical circuit may comprise logical gates, in particular at least one of an AND gate, an OR gate, and a NOT gate. The logical inputs may be processed using the logical gates, preferably resulting in the logical output(s).

The logical circuit may be configured to handle single state fault conditions. Operation of the actuator device may be disabled based on single state fault conditions.

The logical circuit may be implemented in an electronic circuit using electronic components. Each logical gate may be implemented using a corresponding electronic component of the electronic circuit. Generally, the method may be carried out in data processing device. The data processing device may also comprise the electronic circuit. The IVD laboratory system may comprise the data processing device and/or the electronic circuit.

The IVD laboratory system may comprise a housing. At least one of or each of the cover, the cooling device, the cooling device control unit, and the locking device may be arranged at or within the housing. The opening may be configured to provide physical user access to the actuator device. The cover may be configured to prevent physical user access to the actuator device. The cover may, e.g., be a door, a window, or a sleeve.

The IVD laboratory system may be configured to test and/or analyze, in particular essentially automatically, samples such as blood or tissue samples that have been taken from the human body, e.g., samples of a bodily fluid. In-vitro-diagnostics can detect diseases or other conditions and can be used to monitor a person's overall health to help cure, treat, or prevent diseases. The IVD laboratory system may be applied in precision medicine to identify patients who are likely to benefit from specific treatments or therapies. In-vitro-diagnostics tests conducted by the IVD laboratory system may be used in laboratory or other health professional settings.

The IVD laboratory system may comprise one or a plurality of IVD instruments. An IVD instrument can be provided with a plurality of IVD components or (e.g., device or instrument) modules. An IVD instrument can be, for example, a pre-analytical, an analytical, and/or a post-analytical IVD instrument. The IVD instrument may be moved and/or controlled by the actuator device. In the IVD laboratory system, the sample containers may be moved along a line of processing for processing. For example, the sample containers may be moved or relocated from a first IVD instrument to a second IVD instrument provided in the line of processing in the IVD laboratory system. The IVD instruments may provide for an IVD working station or location.

A (biological) sample received in a sample container can comprise a biological material, e.g., as taken from a human body or an animal body. A sample can comprise a body fluid, such as blood, interstitial fluid, urine, saliva, or other types of body fluids.

A sample can potentially comprise at least one analyte of interest, e.g. molecules, ions, proteins, metabolites, pathogens, and the like. It may be one of the tasks of IVD testing to detect the presence resp. absence and/or a concentration of one or more analytes in a sample. More generally, IVD testing can refer to determining a biological property of a sample. IVD testing can comprise performing at least one analytical test on a sample, wherein the analytical test can allow to draw conclusions on the biological properties of the sample. The analytical test can, e.g., comprise adding a reagent to the sample, a possible detectable reaction of the sample with the reagent, and / or a detecting or non-detection of this reaction. Detecting of a reaction can, e.g., comprise measuring a physical value of the sample (resp. a composite obtained by using the sample such as a sample-reagent mixture), such as a spectrum and / or an intensity of a radiation reflected by and/or transmitted through the sample (resp. the composite obtained by using the sample).

Processing a sample may, e.g., comprise transporting the sample (typically in sample containers such as IVD tubes; the sample containers may be held in sample container holders such as tube racks), performing pre-analytical steps on the samples (e.g., preparatory steps such as centrifuging), performing analytical steps on the samples (e.g., adding a reagent to the sample and measuring the reaction of the sample with the reagent), and/or performing post-analytical steps on the samples (e.g., storing of a sample in a refrigerator for later use). Processing a sample may comprise one or more physical processing steps (e.g. moving, mixing, heating, etc.).

The embodiments described above in connection with the method for operating the IVD laboratory system may be provided correspondingly for the IVD laboratory system.

In the following, embodiments, by way of example, are described with reference to figures. In the figures show:.

<FIG> shows a graphical representation of an IVD laboratory system. The IVD laboratory system comprises an actuator device <NUM> for processing (e.g., transporting and/or performing (pre-)analysis steps on) sample containers. The sample containers are configured to respectively contain a sample to be processed or handled for at least one of pre-analysis, analysis, and post-analysis in the IVD laboratory system. A cover <NUM> is provided, e.g., at a housing <NUM>, in order to cover an opening 12a of the housing <NUM> and/or to cover the actuator device <NUM>. The cover <NUM> may be in a closed state such that no user (operator) can access the actuator device <NUM> from outside the housing <NUM>. The cover <NUM> may also be in an open state (dashed line) for user access of the actuator device <NUM>. A locking device <NUM> is provided for locking the cover <NUM>, thus preventing the cover <NUM> from being opened when it is closed. A cooling device (cooler) <NUM> is provided for cooling the sample containers. A (first) cooling device control unit <NUM> and a second cooling device control unit <NUM> are configured to control operation of the cooling device <NUM>. The second cooling device control unit <NUM> controls the cooling device <NUM> only in case of the (first) cooling device control unit <NUM> being inactive.

An actuator device control unit (motion control unit) <NUM> is configured to control and/or enable and/or disable operation of the actuator device <NUM>. Determining whether the actuator device <NUM> is to be enabled or disabled may be carried out in a data processing device <NUM>, e.g., an electronic circuit. The actuator device control unit <NUM> may also be part of the data processing device <NUM>. An emergency user input device <NUM>, e.g., an emergency switch or an emergency button, may be provided. As soon as the emergency user input device is activated (e.g., by pressing the emergency button or by switching the emergency switch), operation of the actuator device <NUM> is disabled.

Disabling or enabling of the actuator device <NUM> depends on a system (operation) mode of the IVD laboratory system. In case the IVD laboratory system is in a normal system mode, operation of the actuator device <NUM> is disabled based on the cover <NUM> being open or the cooling device control unit <NUM> being inactive. In other words, in the normal system mode, operation of the actuator device <NUM> is disabled based on the cover <NUM> being open and operation of the actuator device <NUM> is disabled based on the cooling device control unit <NUM> being inactive.

In contrast, in a bypass system mode, operation of the actuator device <NUM> is disabled based the cover <NUM> being closed or the cooling device control unit <NUM> being inactive. The following table <NUM> shows the actuator device <NUM> being enabled or disabled based on different states of the system, the cover <NUM>, and the cooling device control unit <NUM>.

As Table <NUM> illustrates, the highest priority is assigned to the cooling device control unit state (software state): even when the bypass is activated, the cooling device control unit <NUM> being inactive (e.g., due to a software fault) will always result in disabling of the actuator device <NUM>. The cover state may also be fixed with a locking device state, i.e., the cover <NUM> being open may correspond to the locking device <NUM> being unlocked and the cover <NUM> being closed may correspond to the locking device <NUM> being locked. In this case, the cover state also represents the locking device state. When the cover <NUM> is in a closed state and the bypass is activated, the actuator device <NUM> is disabled in order to prevent a maintenance key (e.g., for switching between normal system mode and bypass system mode) being left inside the housing <NUM>.

Determining the disabling and the enabling of operation of the actuator device <NUM> may be carried out using a logical circuit which comprises a plurality of logical (binary) input states and the actuator device state as logical (binary) output state. In particular, eleven input states, comprising a controller freeze state of the actuator device control unit <NUM>, a controller reset state of the actuator device control unit <NUM>, an emergency user input device state, a cooling device control unit state, a first cover state, a second cover state, a first locking device state, a second locking device state, a first bypass state, a second bypass state, and a safety user input device state may be provided.

A method for operating a IVD laboratory system may thus comprise the steps shown in <FIG>. In an initial step <NUM>, the actuator device <NUM> for processing sample containers, the cover <NUM> configured to cover the actuator device <NUM>, the cooling device <NUM> configured to cool the sample containers, and the cooling device control unit <NUM> configured to control operation of the cooling device <NUM> are provided. In a first step <NUM>, it is determined whether the cover <NUM> is open and, in a second step <NUM>, it is determined whether the cooling device control unit <NUM> is active. In a third step <NUM>, in case the system is in the normal system mode, operation of the actuator device <NUM> is disabled based on at least one of the cover <NUM> being open and the cooling device control unit <NUM> being inactive, and, in case the system is in the bypass system mode, operation of the actuator device <NUM> is enabled based on the cover <NUM> being open and the cooling device control unit <NUM> being active.

The electronic circuit disables the actuator device control units when the cover <NUM> is open and allows for a bypass for maintenance via a switching device 19a (e.g., a key switch). When the key switch is activated, the IVD laboratory system is in the bypass system mode (maintenance mode). The electronic circuit takes into account the state of the cooling device control unit <NUM> (software) via a watchdog control signal of a watchdog unit. While the cooling device control unit software is running, the cooling device <NUM> can be controlled. In case of an error in the cooling device control unit software, the cooling device <NUM> is driven at maximum cooling capacity (e.g., at full speed of a fan) as a preventive measure against excessive temperature. If the software fails, hardware protection will freeze all motion with respect to the actuator device <NUM>. Further, if the locking device state hardware logic is broken, the cover state may be used and vice versa, which contributes to additional redundancy.

In <FIG>, showing a truth table for the logical circuit, the input states corresponding to the controller freeze state of the actuator device control unit <NUM>, the controller reset state of the actuator device control unit <NUM>, the emergency user input device state, the cooling device control unit state, the first cover state, the second cover state, the first locking device state, the second locking device state, the first bypass state, the second bypass state, and the safety user input device state are respectively denoted as: STP_ALL_NFREEZE_MCU, STP_ALL_NRST (MCU), EMERGENCY_SWITCH_GPIO, FANS_STATE_GPIO, Door1_STATE_GPIO, Door2_STATE_GPIO, Lock1_STATE_GPIO, Lock2_STATE_GPIO, SAFETY_BYPASS1_GPIO, SAFETY_BYPASS2_GPIO, and SAFETY_SWITCH_PRESENT_GPIO or "a" to "k".

The input states are processed using logical operations resulting in intermediate states "I" to "p" (denoted as "d' and c", "e and !f" / DOOR_state_GPIO, "g and h" / LOCK_STATE_GPIO, "m and n", and "o'k'ij+oki'j'") and output states "q" to "s" (denoted as "I and p" / SAFE_STATE_ENGAGED, "a and q" / STP_ALL_NFREEZE, and "(a and q)'" / STP_ALL_ENN). An STP_ALL_NFREEZE signal may be transmitted to a motor controller IC pin (NFREEZE pin) and an STP_ALL_ENN signal to a motor driver IC pin (ENN pin). STP_ALL_ENN provides an additional signal to disable the actuator device <NUM> and is used in series with the motor controller IC.

Eleven logical inputs correspond to <NUM><NUM> possible combinations. <FIG> shows relevant input state combinations related to the normal system mode and the bypass system mode in which the actuator device <NUM> is enabled (see column "motor state" (actuator device state)).

The normal system state in which the motor is additionally enabled (can be actuated) occurs when the actuator device control unit (e.g., motion control chips) are not in reset or freeze state, the software of the cooling device control unit <NUM> is running, the emergency e-stop button is not pressed, the housing <NUM> is closed and locked (i.e., the cover <NUM> is closed and the locking device <NUM> is locked), and the bypass is not activated. <FIG> shows one normal system mode combination and a plurality of bypass system mode combinations. This is due to the bypass resulting in ignoring the state of the locking device <NUM> being unlocked and the cover <NUM> being open. When the cover <NUM> is closed and the bypass is activated, the actuator device <NUM> is disabled in order to prevent the maintenance key being left inside the housing <NUM>.

An efficient logical circuit for achieving the truth table according to <FIG> is shown in <FIG>. The input states are respectively provided at input ports <NUM> and processed in logical gates <NUM> to <NUM>, which results in the intermediate states. Logical gates <NUM> correspond to AND gates, logical gate <NUM> corresponds to an OR gate, and logical gate <NUM> to a NOT gate. The output states are provided at output ports <NUM>.

Single fault conditions are handled by the logical circuit as shown in the truth tables according to <FIG> (normal state mode) and <FIG> (bypass state mode). In particular, <FIG> and <FIG> illustrate different situations and results regarding the enabling (comprising bypassing) or disabling of the actuator device <NUM> as shown in column "motor state" when an input error (indicated by boxes <NUM>, <NUM>) occurs. In <FIG>, the normal system state is indicated in the first row and eleven single fault situations (input state combinations) in the remaining rows. <FIG> shows that any single fault failure is detected by the logical circuit and the actuator device <NUM> is thus disabled.

In <FIG>, the first row corresponds to no fault and the remaining rows to the respective eleven single fault conditions for the bypass system mode. If the cover <NUM> is open (cf. columns e, f, Door1_STATE_GPIO is false) and any other signal not related to the cover <NUM> or locking device <NUM> is faulty (columns a to d and i to k), the actuator device <NUM> is disabled. A fault in the signals related to the locking device is bypassed. However, when returning to the normal system mode, the signal fault will be detected and the actuator device <NUM> will be disabled.

The logical circuit may be implemented in an electronic (safety) circuit (e.g., on a printed circuit board, PCB).

In the normal system mode, the inputs logical circuit and the electronic circuit are monitored by software which can disable the actuator device <NUM> and/or the actuator device control unit <NUM>, in particular, the actuator device control subunits. For example, two actuator device control subunits / motor control integrated circuits (e.g., a motor controller such as Trinamic® TMC4361A and a motor driver such as Trinamic® TMC262) may be disabled to put the actuator device <NUM> in a safe state. In particular, a TMC4361A motor controller may be disabled via the NFREEZE pin and a TMC262 motor driver via the ENN pin.

The electronic circuit allows for monitoring the input states. The cover <NUM>, the locking device <NUM>, and the bypass signals each have two input states to the electronic circuit which should reflect the same state at all times. Such dual redundant states allow for detection of faults in the wiring of the electronic circuit or the locking device <NUM>. Each redundant input state is monitored by both hardware and software, although both operate independently.

If any of the cover state, the locking device state, and the cooling device control unit state indicates the actuator device <NUM> should be disabled, the SAFE_STATE_ENGAGED_N signal is activated by the logical circuit. This signal is connected to the same signals used for controlling the actuator device <NUM>, namely NFREEZE (STP_ALL_NFREEZE) and ENN (STP_ALL_ENN). In addition to disabling power of the actuator device <NUM>, a brake is applied, e.g., to a lift axis to prevent the lift axis from dropping when power is disabled.

The electronic circuit ensures that a single fault condition cannot render the IVD laboratory system unsafe or cause a hazard to the operator when the cover <NUM> is open. In case of no <NUM> V supply, the electronic circuit will not be powered and the actuator device <NUM> will stop as it will not be supplied with the required control signals.

The switching device may be a key switch configured to receive a key for switching and may, e.g., comprise an Eaton® M22-K01 device. This switch has a normally open output and a normally closed output. When the key switch is activated, a <NUM> V signal is fed to the inputs of the electronic circuit. Using a normally open contact and a normally closed contact allows for detection of a broken wire.

The contacts of the switching device require a minimum current of <NUM> mA. Each switching device input is provided with a resistor with <NUM> kΩ. Resistors set the current of each contact to ISwitch = U/R = <NUM> V / <NUM> kΩ = <NUM> mA. A voltage divider (<NUM> kΩ and <NUM> kΩ) generates <NUM> V on a NC7WZ17 input.

<FIG> shows a graphical representation of a cooling device control circuit. Deterioration of the samples in the sample containers can occur if the temperature of the sample is, e.g., more than <NUM> above room temperature. To ensure the temperature is adequately controlled, the cooling device <NUM>, which comprises a plurality of fans, is controlled by the software-implemented (first) cooling device control unit <NUM> and the second cooling device control unit <NUM>. The speed of the fans is controlled by the software of the cooling device control unit <NUM>. Since the software is not capable of mitigating a hazard, independent hardware (the second cooling device control unit <NUM>) is provided to ensure the fans continue to operate following a software failure. This is achieved via an external watchdog unit <NUM> and a latch <NUM>.

The software of the cooling device control unit <NUM> provides a "sign of life" heartbeat signal <NUM> to the watchdog unit <NUM>, e.g., a watchdog IC, which needs to be provided at least once every <NUM>. Provided this requirement is met, the software can alter the speed of the fans. During a software failure event, the heartbeat signal will cease to be transmitted and the watchdog unit <NUM> will produce a reset signal / reset pulse <NUM>. The reset signal <NUM> is transmitted to a clear input of the latch <NUM>. The heartbeat signal <NUM> is also connected to a clock input of the latch IC <NUM>. In case the (first) cooling device control unit <NUM> is active, the heartbeat signal <NUM> will produce a high output at the latch <NUM>. During a software failure event, the reset pulse <NUM> from the watchdog unit <NUM> clears the latch <NUM> resulting in a low state output from the latch <NUM>. A low output will transfer fan control to the more robust hardware (the second cooling device control unit <NUM>), which will continue to control the fans at full speed until the heartbeat signal <NUM> reappears. The state of the fan control (cooling device control unit state), hardware or software, is passed to the electronic circuit of the IVD laboratory system.

The locking device <NUM> may comprise a safety (inter)lock, e.g., an Idec® HS5L-VD7Y4M-G safety lock. The locking device <NUM> allows for determining whether the cover <NUM> is open or closed. In particular, a cover position (e.g., door position) may be determined. Further, it may be determined whether the locking device <NUM> is locked by detecting the state of a solenoid of the locking device <NUM>. When the cover <NUM> is closed and the locking device <NUM> is locked, the locking device outputs are <NUM> V. The solenoid will lock the cover <NUM> to prevent user access. The user has to request access (via an input device) before the locking device <NUM> is unlocked. The locking device <NUM> can for example be unlocked with a software request by the user (e.g., for carrying out preventative maintenance activities). When the locking device <NUM> is unlocked, the actuator device <NUM> will be disabled instantaneously.

Table <NUM> provides an overview of the different statuses of the locking device <NUM>. Status <NUM> corresponds to a user access request, while the cover <NUM> (barrier) is in a closed position. In status <NUM>, the locking device <NUM> is in a locked position, but the cover <NUM> is open.

Claim 1:
Method for operating an in-vitro-diagnostics laboratory system, IVD laboratory system, the IVD laboratory system having
- a housing (<NUM>) with an opening (12a);
- an actuator device (<NUM>), arranged in the housing (<NUM>), for processing sample containers;
- a cover (<NUM>) configured to cover the opening (12a);
- a cooling device (<NUM>) configured to cool the sample containers; and
- a cooling device control unit (<NUM>) configured to control operation of the cooling device (<NUM>);
wherein the method comprises:
- determining whether the cover (<NUM>) is open;
- determining whether the cooling device control unit (<NUM>) is active;
- in a normal system mode, disabling operation of the actuator device (<NUM>) based on at least one of the cover (<NUM>) being open and the cooling device control unit (<NUM>) being inactive; and
- in a bypass system mode, enabling operation of the actuator device (<NUM>) based on the cover (<NUM>) being open and the cooling device control unit (<NUM>) being active.