Patent Description:
The present invention relates generally to computer-aided medical systems, and more particularly to joint brakes of a computer-aided medical system.

Teleoperated system <NUM> is a computer-aided medical system (for example, a minimally invasive surgical system) that includes an endoscopic imaging system <NUM>, a surgeon's console <NUM> (master), and a patient side support system <NUM> (slave), all interconnected by wired (electrical or optical) or wireless connections <NUM>. One or more electronic data processors may be variously located in these main components to provide system functionality. Examples are disclosed in U. Patent No. <CIT>.

Imaging system <NUM> performs image processing functions on, e.g., captured endoscopic imaging data of the surgical site and/or preoperative or real time image data from other imaging systems external to the patient. Imaging system <NUM> outputs processed image data (e.g., images of the surgical site, as well as relevant control and patient information) to a surgeon at surgeon's console <NUM>. In some aspects, the processed image data is output to an optional external monitor visible to other operating room personnel or to one or more locations remote from the operating room (e.g., a surgeon at another location may monitor the video; live feed video may be used for training; etc.).

Surgeon's console <NUM> includes multiple degrees-of-freedom ("DOF") mechanical input devices ("masters") that allow the surgeon to manipulate the instruments, entry guide(s), and imaging system devices, which are collectively referred to as slaves. These input devices may in some aspects provide haptic feedback from the instruments and surgical device assembly components to the surgeon. Console <NUM> also includes a stereoscopic video output display positioned such that images on the display are generally focused at a distance that corresponds to the surgeon's hands working behind/below the display screen. These aspects are discussed in <CIT>.

Base <NUM> of patient side support system <NUM> supports an arm assembly that includes a passive setup arm assembly <NUM> and an actively controlled manipulator arm assembly <NUM>. Actively controlled manipulator arm assembly <NUM> is referred to as entry guide manipulator <NUM>.

In one example, setup arm assembly <NUM> includes two passive rotational setup joints <NUM> and <NUM>. Rotational setup joints <NUM> and <NUM> allow manual positioning of coupled setup links <NUM> and <NUM> if the joint brakes for setup joints <NUM> and <NUM> are released. Alternatively, some of these setup joints may be actively controlled, and more or fewer setup joints may be used in various configurations. Setup joints <NUM> and <NUM> and setup links <NUM> and <NUM> allow a person to place entry guide manipulator <NUM> at various positions and orientations in Cartesian x, y, and z space. Specifically, setup joints <NUM> and <NUM> allow positioning in a (x, y) plane, and setup link <NUM> allows positioning in the z dimension. In particular, a prismatic setup joint (not shown) between setup link <NUM> of setup arm assembly <NUM> and base <NUM> may be used for vertical adjustments <NUM>.

As shown in <FIG>, a manipulator assembly yaw joint <NUM> is coupled between an end of setup link <NUM> and a first end, e.g., a proximal end, of a first manipulator link <NUM>. Yaw joint <NUM> allows first manipulator link <NUM> to move with reference to setup link <NUM> in a motion that may be arbitrarily defined as "yaw" around a manipulator assembly yaw axis <NUM>. As shown, the rotational axis of yaw joint <NUM> is aligned with remote center of motion <NUM>, which is generally the position at which an instrument enters the patient (e.g., at the umbilicus for abdominal surgery).

In one embodiment, setup link <NUM> is rotatable in a horizontal or x, y plane and yaw joint <NUM> is configured to allow first manipulator link <NUM>, sometimes referred to as link <NUM>, in entry guide manipulator <NUM> to rotate about yaw axis <NUM>. Setup link <NUM>, yaw joint <NUM>, and first manipulator link <NUM> provide a constantly vertical yaw axis <NUM> for entry guide manipulator <NUM>, as illustrated by the vertical line through yaw joint <NUM> to remote center of motion <NUM>.

A distal end of first manipulator link <NUM> is coupled to a proximal end of a second manipulator link <NUM>, sometimes referred to as link <NUM>, by a first actively controlled rotational joint <NUM>. A distal end of second manipulator link <NUM> is coupled to a proximal end of a third manipulator link <NUM>, sometimes referred to as link <NUM>, by a second actively controlled rotational joint <NUM>. A distal end of third manipulator link <NUM> is coupled to a distal portion of a fourth manipulator link <NUM>, sometimes referred to as link <NUM>, by a third actively controlled rotational joint <NUM>.

In one embodiment, links <NUM>, <NUM>, and <NUM> are coupled together to act as a coupled motion mechanism. Coupled motion mechanisms are well known (e.g., such mechanisms are known as parallel motion linkages when input and output link motions are kept parallel to each other). For example, if rotational joint <NUM> is actively rotated, joints <NUM> and <NUM> are also actively rotated so that link <NUM> moves with a constant relationship to link <NUM>. Therefore, it can be seen that the rotational axes of joints <NUM>, <NUM>, and <NUM> are parallel. When these axes are perpendicular to rotational yaw axis <NUM> of yaw joint <NUM>, links <NUM>, <NUM> and <NUM> move with reference to link <NUM> in a motion that may be arbitrarily defined as "pitch" around a manipulator assembly pitch axis.

The manipulator pitch axis extends into and out of the page in <FIG> at remote center of motion <NUM>, in this aspect. The motion around the manipulator assembly pitch axis is represented by arrow <NUM>. Since links <NUM>, <NUM>, and <NUM> move as a single assembly, first manipulator link <NUM> may be considered an active proximal manipulator link, and second through fourth manipulator links <NUM>, <NUM>, and <NUM> may be considered collectively an active distal manipulator link.

An entry guide manipulator assembly platform <NUM>, sometimes referred to as platform <NUM>, is coupled to a distal end of fourth manipulator link <NUM>. An entry guide manipulator assembly <NUM> is rotatably mounted on platform <NUM>. Entry guide manipulator assembly <NUM> includes an instrument manipulator positioning system.

Entry guide manipulator assembly <NUM> rotates plurality of instrument manipulator assemblies <NUM> as a group around axis <NUM>. Specifically, entry guide manipulator assembly <NUM> rotates as a single unit with reference to platform <NUM> in a motion that may be arbitrarily defined as "roll" around an entry guide manipulator assembly roll axis <NUM>, sometimes referred to as axis <NUM>.

Each of a plurality of instrument manipulator assemblies <NUM> is coupled to entry guide manipulator assembly <NUM> by a different insertion assembly <NUM> (also called "insertion mechanism <NUM>"). In one aspect, each insertion assembly <NUM> is a telescoping assembly that moves the corresponding instrument manipulator assembly away from and towards entry guide manipulator assembly <NUM>. In <FIG>, each of the insertion assemblies is in a fully retracted position.

Each of the plurality of instrument manipulator assemblies includes a plurality of motors that drive a plurality of outputs in an output interface of that instrument manipulator assembly. See <CIT>, for one example of an instrument manipulator assembly and a surgical instrument that can be coupled to the instrument manipulator assembly.

The joint brakes for rotational setup joints <NUM> and <NUM> are each a single brake that performs several functions. As discussed above during setup, the joint brakes for setup joints <NUM> and <NUM> are released to allow manual positioning of coupled setup links <NUM> and <NUM>.

To help ensure that setup joints <NUM> and <NUM> don't move inadvertently in a fault condition, the joint brakes are power-off brakes, e.g., a brake that requires power to physically disengage in normal operation. To help ensure that the surgical tools can still be pushed out of the way to access the patient during an emergency, a maximum torque, referred to as an egress torque, that the single joint brake may apply is specified. Above this egress torque, the joint brake slips.

To reduce or minimize vibration of the end effector during a procedure (e.g., the cannula and the instrument tips), a stationary setup joint (e.g., setup joints <NUM> and <NUM>) applies a force or torque opposing to the forces or torques required to accelerate and decelerate components (e.g., entry guide manipulator <NUM>) physically coupled between the setup joint and the end effector. For a procedure performed using patient side support system <NUM>, the required torque during a procedure at setup joints <NUM> and <NUM> is applied using the joint brake in each joint.

<CIT> discloses a robotic surgical system that includes a robotic arm comprising a first segment having a first plurality of links and a first plurality of actuated joint modules providing the robotic arm with at least five degrees of freedom, and a second segment having a proximal end coupled to a distal end of the first segment, and comprising a second plurality of links and a second plurality of actuated joint modules providing the robotic arm with at least two degrees or freedom. The robotic surgical system further comprises an instrument driver coupled to the second segment and configured to hold a surgical instrument. The second arm segment is configured to move the surgical instrument within a generally spherical workspace, and the first arm segment is configured to move the location of the spherical workspace.

The present invention is defined by appended claim <NUM>.

A system, e.g., a computer-aided medical system, includes a first link, a second link, a joint, and a dual brake assembly. The first link has a first end portion and a second end portion. The second link has a first end portion and a second end portion. The joint is connected to the second end portion of the first link and to the first end portion of the second link. The dual brake assembly is coupled to the first link and to the second link.

The dual brake assembly includes a first brake and a second brake. Braking provided by the dual brake assembly reduces relative motion between the first and second links.

The first brake provides a first brake holding strength when physically engaged and the second brake provides a second brake holding strength when physically engaged. The second brake holding strength being different from the first brake holding strength, and in one aspect, the second brake holding strength is larger than the first brake holding strength.

In another aspect, the first brake is physically engaged when unpowered, and the second brake is physically disengaged when unpowered. The first brake is implemented as an actuator brake, and the second brake is implemented as a joint brake.

If the system is in a power off state, the first brake is unpowered and physically engaged and the second brake is unpowered and physically disengaged. If the system is in a fault state, a controller causes the first brake to be physically engaged and the second brake to be physically disengaged. If the system is in a clutch mode, the controller causes the first brake to be physically disengaged and the second brake to be physically disengaged. During a procedure, the controller causes the first brake to be physically disengaged and the second brake to be physically engaged.

In another aspect, the system includes an actuator and a controller. The actuator is coupled to the joint. Activation of the actuator causes the joint to move the second link relative to the first link. The controller is configured to cause the first brake to be physically engaged and the second brake to be physically engaged to restrict movement of the second link relative to the first link upon failure of the actuator in a state configured to cause movement of the second link relative to the first link.

In yet another aspect, not according to the present invention, the first brake and the second brake comprise a single brake. The system further includes an actuator having a housing and a shaft extending from the housing. The single brake is coupled to the actuator housing and to the shaft. In a first state, the single brake has a first holding strength and in a second state, the single brake has a second holding strength. The first holding strength is different from the second holding strength.

The single brake includes a brake rotor, a caliper and a variable load assembly. The brake rotor is mounted on the shaft. The caliper is coupled to the housing. The variable load assembly is coupled to the caliper. In a first state, the variable load assembly applies a first force on the caliper, and in a second state the variable load assembly applies a second force on the caliper. The first force is different from the second force.

In still another aspect, the controller is coupled to the first brake and to the second brake and the controller is configured to:.

A method of controlling motion of a second link relative to a first link in a system includes physically disengaging a first brake and physically disengaging a second brake to allow free movement of the second link relative to the first link, and physically engaging the first brake and physically disengaging the second brake to restrict movement of the second link relative to the first link. The method also includes physically disengaging the first brake and physically engaging the second brake during a procedure performed using the system, and physically engaging the first brake and physically engaging the second brake to restrict movement of the second link relative to the first link upon failure of an actuator in a state configured to cause movement of the second link relative to the first link.

A computer-aided medical system includes a patient side support system. The patient side support system includes a controller, a first link, a second link, and a joint assembly. The first link has a first end portion and a second end portion. The second link has a first end portion and a second end portion. The joint assembly is connected to the second end portion of the first link and to the first end portion of the second link.

The joint assembly includes an actuator and a dual brake assembly. The actuator is configured to cause the joint assembly to move the second link relative to the first link. The dual brake assembly is coupled to the first link, to the second link, and to the actuator. The dual brake assembly includes a first brake and a second brake.

The controller is coupled to the actuator and to the dual brake assembly. The controller is configured to command the dual brake assembly to reduce relative motion between the first and second links.

Also, in this aspect, the first brake is physically engaged when unpowered, and the second brake is physically disengaged when unpowered. The first brake is implemented as an actuator brake, and the second brake is implemented as a joint brake.

If the computer-aided medical system is in a power off state, the first brake is unpowered and physically engaged and the second brake is unpowered and physically disengaged. If the computer-aided medical system is in a system fault state, the controller causes the first brake to be physically engaged and the second brake to be physically disengaged. If the computer-aided medical system is in a clutch mode, the controller causes the first brake to be physically disengaged and the second brake to be physically disengaged.

During a procedure, the controller causes the first brake to be physically disengaged and the second brake to be physically engaged. Alternatively, the second brake can also be engaged only during movements of distal components of the computer-aided medical system that produce a torque larger that torques that can be counteracted by the actuator. When the components of the computer-aided medical system are relatively stationary, or moving with torque less than torques that can be controlled by the actuator, the actuator at the joint is sufficient to counteract the torque required to accelerate the distal components, and so the second brake is physically disengaged.

In the drawings, for single digit figure numbers, the first digit in the reference numeral of an element is the number of the figure in which that element first appears.

Herein, a patient side support system <NUM> of a computer-aided medical system (<FIG>) is first used as an example of a system that includes a dual <NUM> brake assembly that includes two portions. The first portion provides a first brake holding strength, when physically engaged, while the second portion provides a second brake holding strength, when physically engaged. The second brake holding strength is different from the first brake holding strength. In one aspect, the second brake holding strength is larger than the first brake holding strength. Herein, brake holding strength is sometimes referred to as holding strength. In various embodiments, the holding strength comprises one or more forces, torques (or moments), combination of forces or torques, etc. The use of patient side support system <NUM> is illustrative only and is not intended to limit use of the dual brake assembly to this one application. As described more completely below, the dual brake assembly can be utilized in a variety of systems.

In one aspect, joint assembly <NUM> in a patient side support system <NUM> includes a joint and a dual brake assembly <NUM>. The joint rotatably couples first link <NUM> to second link <NUM>. Dual brake assembly <NUM> provides the necessary braking functionality during all stages of operations of computer-aided medical system <NUM> without the compromises needed in the prior art systems with a single brake assembly associated with a joint. Sometimes, dual brake assembly <NUM> is referred to as brake assembly <NUM>.

In one aspect, dual brake assembly <NUM> of joint assembly <NUM> includes two portions. The first portion provides a first brake holding strength, when physically engaged, while the second portion provides a second brake holding strength, when physically engaged. The second brake holding strength is different from the first brake holding strength. In one aspect, the second brake holding strength is larger than the first brake holding strength.

During a procedure performed with computer-aided medical system <NUM>, in one aspect, the second portion of dual brake assembly <NUM> is engaged to prevent movement of second link <NUM> relative to first link <NUM>. This restricts motion of yaw axis <NUM> of patient side support system <NUM> relative to a rotational axis <NUM> of joint assembly <NUM>, which in turn minimizes vibration during the procedure. Rotational axis <NUM> of joint assembly <NUM> is parallel to yaw axis <NUM>.

In the prior art system, with a single brake to achieve the necessary holding strength during a procedure, the egress torque was raised so that in some situations two average humans were required to apply the force required to make the single brake slip. (The number of required humans depended on their individual pushing power) The maximum holding strength of the brake during a procedure was still limited by requiring that users be able make the brake slip during an emergency. In contrast, the brake holding strength of the second portion of dual brake assembly <NUM> can be made as strong as necessary to dampen vibrations during a procedure, because dual brake assembly <NUM> decouples the requirements for a maximum holding strength during a procedure and for a user being able to make dual brake assembly <NUM> slip when needed.

For example, if computer-aided medical system <NUM> enters a fault state, controller <NUM> disengages the second portion of dual brake assembly <NUM> and engages the first portion of the dual brake assembly <NUM> in joint assembly <NUM>. This releases the high brake holding strength of the second portion of dual brake assembly <NUM> and physically engages the smaller brake holding strength of the first portion of dual brake assembly <NUM>. Engaging the first portion of dual brake assembly <NUM> in a fault state ensures that second link <NUM> does not move unintentionally, e.g., due to the effects of gravity. Fault states may be triggered by any number of environmental and operational parameters, including unexpected system operation, system movement that deviate from commanded movement, operator input or lack of input, interruption in power supply, emergency situations, etc. The holding strength of the first portion of the dual brake assembly <NUM> is such that second link <NUM> can be pushed out of the way in an emergency by a user so that a patient can be accessed.

As explained more completely below, in one aspect, when a master clutch activation is commanded, dual brake assembly <NUM> physically disengages all the braking capability in joint assembly <NUM> so that second link <NUM> can move freely relative to first link <NUM>. In this aspect, first link <NUM> is proximal to second link <NUM>, and so could be referred to as a proximal link. In this case, second link <NUM> would be a distal link. When the master clutch activation is dropped, the dual brake assembly engages the braking capability in joint assembly <NUM> to restrict motion of second link <NUM> relative to first link <NUM>, e.g., the second portion of dual brake assembly <NUM> is physically engaged, in one aspect.

In another aspect, when the master clutch activation is dropped, all the braking capability of dual brake assembly <NUM> remains disengaged. The controller uses the actuator in joint assembly <NUM> to restrict motion of second link <NUM> relative to first link <NUM>, until the actuator is insufficient or marginal to reduce vibration, e.g., when a command to move entry guide manipulator <NUM> is issued that requires a holding strength greater than can be supplied by the actuator, the controller issues a command to physically engage the second portion of dual brake assembly <NUM>. Thus, in this aspect, dual brake assembly <NUM> is not engaged until dual brake assembly <NUM> is needed to control vibrations.

To help ensure that the joint in joint assembly <NUM> does not unintentionally move when power is off, the first portion of the dual brake assembly <NUM> is engaged so that motion of second link <NUM> relative to first link <NUM> is restricted. This helps to assure, for example, that during transportation (e.g., moving the system to another room or to another location in a room), the links in patient side support system <NUM> remain in the desired position.

The two portions of dual brake assembly <NUM> provide capabilities that were not previously available in a joint with a single brake due to the limitations on the holding strength of the single brake. As described previously, the brake holding strength of a single brake when engaged had to be such that application of the egress torque/force would cause the brake to slip. (Herein, egress torque/force means that if a rotational joint is used, a human or humans apply an egress force on a link distal to the rotational joint such that the egress torque is applied to the rotational joint, and if a prismatic joint is used, an egress force is applied to a link distal to the prismatic joint by one or more humans. ) This limited the holding strength available to minimize vibrations during a procedure and the holding strength available to stop a condition in which a joint actuator failed in active state, e.g., a motor run-away condition.

For example, in teleoperated system <NUM>, inertia of entry guide manipulator <NUM> is large due to its size, mass, and mechanical design, and so the torque required to accelerate entry guide manipulator <NUM> about yaw axis <NUM> must be sufficient to overcome the inertia of entry guide manipulator <NUM>. Since yaw axis <NUM> and shoulder axis <NUM> are parallel, a torque at yaw axis <NUM> is reacted to by a similar magnitude torque at shoulder axis <NUM>. For some moves of entry guide manipulator <NUM>, the reaction load torque is large enough that the brake torque requirement for setup joint <NUM> would exceed the allowable egress torque, so a single unaided brake solution could not have an egress torque and also counteract torques on yaw axis <NUM> that could introduce vibrations.

The configuration of computer-aided medical system <NUM> is similar to that in teleoperated system <NUM> in that to accelerate entry guide manipulator <NUM> about yaw axis <NUM>, a torque sufficient to overcome the inertia of entry guide manipulator <NUM> is required. Since yaw axis <NUM> and shoulder axis <NUM> are parallel, a torque at yaw axis <NUM> is reacted by a similar magnitude torque at shoulder axis <NUM>. However, the two portions of dual brake assembly <NUM> allows dual brake assembly <NUM> to provide the required braking capability during a procedure to minimize vibrations, while at other times assuring that the torque required to move entry guide manipulator <NUM> does not exceed the egress torque. Similarly, dual brake assembly205 is configured to counteract a condition in which a joint actuator fails in an active state. e.g., a motor runaway condition, so that motion of second link <NUM> relative to first link <NUM> is restricted. Thus, dual brake assembly <NUM> provides a range of capabilities that were not available in teleoperated system <NUM>.

Prior to considering dual brake assembly <NUM> in further detail, computer-aided medical system <NUM> is described more completely. Patient side support system <NUM> is part of a computer-aided medical system that includes a controller <NUM>, an operator's console <NUM>, and an endoscopic imaging system <NUM>. Controller <NUM>, operator's console <NUM>, and endoscopic imaging system <NUM> are interconnected to patient side support system <NUM> and to each other by wired (electrical or optical) or wireless connections.

A base <NUM> of patient side support system <NUM> supports an arm assembly that includes an actively controlled setup arm assembly <NUM> and an actively controlled manipulator arm assembly <NUM>. Actively controlled manipulator arm assembly <NUM> is referred to as entry guide manipulator <NUM>. Herein, actively controlled means that the device is under the control of a controller.

In this example, setup arm assembly <NUM> includes first link <NUM> (which is a first setup link in this example), a joint assembly <NUM>, second link <NUM> (which is a second setup link in this example), and a third link <NUM> (which is a third setup link). A first prismatic joint (not visible) moves first link <NUM> into and out of base <NUM>, i.e., moves first link <NUM> in first and second directions, to adjust the vertical height of second link <NUM> and third link <NUM> and thereby adjust the vertical height of entry guide manipulator <NUM>. Joint assembly <NUM> (which in this example could also be referred to as a shoulder joint assembly or a rotational joint assembly) allows rotational positioning of coupled second link <NUM> and third link <NUM>. A second prismatic joint (not visible) moves third link <NUM> into and out of second link <NUM>, i.e., moves third link <NUM> in third and fourth directions, to adjust the horizontal position of entry guide manipulator <NUM>.

The structure of entry guide manipulator <NUM> is similar to entry guide manipulator <NUM> described above. Specifically, the configuration and operation of links <NUM>, <NUM>, <NUM>, <NUM>, joints <NUM>, <NUM>, <NUM>, platform <NUM>, the entry guide manipulator assembly, the insertion assemblies, and plurality of instrument manipulator assemblies <NUM> of patient side support system <NUM> are the same as the configuration and operation of links <NUM>, <NUM>, <NUM>, <NUM>, joints <NUM>, <NUM>, <NUM>, platform <NUM>, entry guide manipulator assembly <NUM>, insertion assemblies <NUM>, and plurality of instrument manipulator assemblies <NUM> of patient side support system <NUM>. Thus, the description of the configuration and operation of links <NUM>, <NUM>, <NUM>, <NUM>, joints <NUM>, <NUM>, <NUM>, platform <NUM>, entry guide manipulator assembly <NUM>, insertion assemblies <NUM>, and plurality of instrument manipulator assemblies <NUM> of patient side support system <NUM> is not repeated here for the configuration and operation of links <NUM>, <NUM>, <NUM>, <NUM>, platform <NUM>, the entry guide manipulator assembly, the insertion assemblies, and plurality of instrument manipulator assemblies <NUM> of patient side support system <NUM>.

Controller <NUM> is connected to each of the actively controlled joints in patient side support system <NUM>, to actuators that control the operation of the insertion assemblies, and to plurality of instrument manipulator assemblies <NUM>. Herein, when it is stated that controller <NUM> performs an act, it means that controller <NUM> issues a command or signal to a component that performs the act in response to the command or signal.

Herein, a single controller is referenced and described. Although described as a single controller, it is to be appreciated that this controller may be implemented in practice by any one of or any combination of hardware, software that is executed on a processor, and firmware. Also, a controller's functions, as described herein, may be performed by one unit or divided up among different components, each of which may be implemented in turn by any one of or any combination of hardware, software that is executed on a processor, and firmware. When divided up among different components, the components may be centralized in one location or distributed across the computer-aided medical system for distributed processing purposes.

A processor should be understood to include at least a logic unit and a memory associated with the logic unit. Thus, in various embodiments, a controller system includes programmed instructions (e.g., a non-transitory machine-readable medium storing the instructions) to implement some or all of the methods described in accordance with aspects disclosed herein. Any of a wide variety of centralized or distributed data processing architectures may be employed. Similarly, the programmed instructions may be implemented as a number of separate programs or subroutines, or they may be integrated into a number of other aspects of the systems described herein. In some embodiments, the controller system supports wireless communication protocols such as Bluetooth, Infrared Data Association (IrDA) protocol, Home Radio Frequency (HomeRF) protocol, IEEE <NUM> protocol, Digital Enhanced Cordless Telecommunications (DECT) protocol, and Wireless Telemetry protocol.

As described above, dual brake assembly <NUM> is included in a shoulder joint assembly, which includes a rotational joint. However, the novel dual brake assembly is not limited to use in rotational joints. The dual brake assembly can also be used, for example, with a prismatic joint.

Also, the dual brake assembly can be used in actively controlled joints and in passive joints. An actively controlled joint is a joint that includes an actuator (e.g., a motor) configured to move or assist motion of the actively controlled joint, and the actively controlled joint couples one link to another link. A controller uses the actuator to move one link relative to the other link. While a passive joint also couples one link to another link, a passive joint does not include an actuator configured to move the passive joint. Thus, to move a passive link, a user supplies the necessary torque/force.

In general, as illustrated in <FIG>, a system includes a first link 302A (e.g., a proximal link) having a first end portion and a second end portion and a second link 304A (e.g., a distal link) having a first end portion and a second end portion. A joint assembly 303A connects the second end portion of first link 302A and to the first end portion of second link 304A so that second link 304A can be moved relative to first link 302A. Use of a joint, prismatic or rotational, two couple two links in a system is known, and so is not described in further detail here.

Joint assembly 303A includes a dual brake assembly 305A. Dual brake assembly 305A is coupled to first link 302A and to second link 304A. Dual brake assembly 305A is actively controlled by a controller, such as controller <NUM>.

While in this example, dual brake assembly 305A is included in joint assembly 303A, this is illustrative only and is not intended to be limiting. In general, dual brake assembly 305A includes two portions, a first portion that provides braking when dual brake assembly 305A is not powered, and a second portion that provides braking when dual brake assembly 305A is powered.

Above, dual brake assembly <NUM> is described as including two portions. The first portion provides a first brake holing strength, when physically engaged, while the second portion provides a second brake holding strength, when physically engaged. The second brake holding strength is different from the first brake holding strength, and in one aspect, the second brake holding strength is larger than the first brake holding strength. Similarly, each of the dual brake assemblies, described herein, includes similar two portions. In one aspect, the first portion is a first brake and the second portion is second brake. In all examples of the dual brake assembly including dual brake assembly 305A, the dual brake assembly reduces relative motion between the first and second links coupled to the dual brake assembly.

A controller is coupled to dual brake assembly 305A to control the states of the first brake and the second brake. In one aspect, if the system is in a fault state, the controller causes the first brake to be physically engaged and the second brake to be physically disengaged. If the system is in a clutch mode, the controller causes the first brake to be physically disengaged and the second brake to be physically disengaged. During a procedure, the controller causes the first brake to be physically disengaged and the second brake to be physically engaged.

Herein, when it is stated that a brake is engaged or is physically engaged, it means that the brake provides at least some braking. When it is stated that a brake is disengaged or is physically disengaged, it means that the brake does not provide braking.

<FIG> are schematic diagrams of possible implementations of joint assembly 303A and dual brake assembly 305A of <FIG>, and <FIG> are configurations that include an actively controlled joint, while <FIG> is a configuration that includes a passive joint.

In <FIG>, a system includes a first link 302B (e.g., a proximal link) having a first end portion and a second end portion and a second link 304B (e.g., a distal link) having a first end portion and a second end portion. A joint assembly 303B connects the second end portion of first link 302B and to the first end portion of second link 304B so that second link 304B can be moved relative to first link 302B. Joint assembly 303B includes a joint and a dual brake assembly 305B. The joint is actively controlled by a controller. Dual brake assembly 305B is coupled to first link 302B and to second link 304B. In this example, dual brake assembly 305B is included in joint assembly 303B. However, this is illustrative only and is not intended to be limiting. Dual brake assembly 305B includes two portions, e.g., an actuator brake 305B1 (a first brake) and a joint brake 305B2 (a second brake).

In the example of <FIG>, joint assembly 303B also includes an actuator 306B and a transmission assembly 307B that are configured to move second link 304B relative to first link 302B. The output of actuator 306B is input to transmission assembly 307B. The output of transmission assembly 307B moves second link 304B.

Actuator 306B can be an electric motor, a pneumatic actuator, a hydraulic actuator, etc. Transmission assembly 307B reduces the output of actuator 306B to an output that is suitable for moving second link 304B relative to first link 302B. When actuator 306B is an electric motor, transmission assembly 307B can be, for example, a harmonic drive.

In <FIG>, the housings of actuator brake 305B1, actuator 306B, transmission assembly 307B, and joint brake 305B2 are stationary relative to first link 302B. Joint brake 305B2 is connected to second link 304B, while actuator brake 305B1 brakes the output of actuator 306B.

During a procedure performed using the system, in one aspect, joint brake 305B2 is physically engaged by a controller, and so provides braking. Actuator brake 305B1 is physically disengaged, and so does not provide braking.

In this aspect, joint brake 305B2 is configured to provide braking on second link 304B so that in response to reaction loads on second link 304B, second link 304B remains approximately stationary relative to first link 302B. Maintaining second link 304B approximately stationary during a procedure performed using the system minimizes vibration of any device, such as an instrument (e.g., a medical instrument such as a surgical instrument), coupled to the second end portion of second link 304B. Herein, approximately stationary means that any movement of second link relative to the first link does not cause the instrument coupled to second link 304B to move more than a predetermined acceptable amount. In one aspect the predetermined acceptable amount is one to three millimeters. Also, when stationary is used with respect to action of a brake on a link, it is understood that some small amount of movement of the link is acceptable so long as the small amount of movement does not result in the instrument moving more than the predetermined acceptable amount.

The braking provided by joint brake 305B2 during a procedure can be as large as necessary to restrict movement of second link 304B in response to reaction loads, without concern for being able to move second link 304B in a fault condition. In one aspect, joint brake 305B2 provides braking, e.g., is physically engaged, so long as a fault condition does not occur. In another aspect, the controller uses actuator 306B to restrict motion of second link 304B relative to first link 302B, until actuator 306B is insufficient or marginal to reduce vibration, e.g., when a command to move an assembly coupled to second link 304B is issued that requires a holding strength greater than can be supplied by actuator 306B, the controller issues a command to physically engage joint brake 305B2 of dual brake assembly 305B. Thus, in this aspect, joint brake 305B2 is not engaged until dual brake assembly <NUM> is needed to control vibrations.

If a fault condition occurs and if joint brake 305B2 is physically engaged, joint brake 305B2 is physically disengaged by the controller, and so provides no braking on joint assembly 303B. Thus, in a fault condition, joint brake 305B2 does not inhibit movement of second link 304B relative to first link 302B.

Actuator brake 305B1 is configured to restrict movement of second link 304B relative to first link 306B1 when power is off to dual brake assembly (e.g., the system is powered down) and in a fault condition. In one aspect, actuator brake 305B1 is a power-off brake, so that when power is removed from actuator brake 305B1, actuator brake 3025B <NUM>, (a first brake) provides braking on joint assembly 303B to restrict movement of second link 304B relative to first link 302B. However, the strength of actuator brake 305B <NUM> is designed so that the braking allows the actuator brake 305B <NUM> to slip in an emergency when sufficient force is applied to move second link 304B relative to first link 302B. In a fault condition, dual brake assembly 305B still provides braking, but allows movement of second link 304B relative to first link 302B if sufficient force is applied on second link 304B to cause actuator brake 305B <NUM> to slip.

Recall that in this aspect during a procedure being performed using the system, joint brake 305B2 is physically engaged and actuator brake 305B <NUM> is physically disengaged. If during the procedure, actuator 306B fails in an always on state, e.g., a motor run-away condition for an electric motor actuator, actuator brake 305B1 is physically engaged to counteract the actuator failure. In one aspect, a predetermined time after the always on fault is detected by the controller, the controller disengages joint brake 305B2. In another aspect, if during the procedure, actuator 306B fails in an always on state, e.g., a motor run-away condition for an electric motor actuator, actuator brake 305B <NUM> is physically engaged to counteract the actuator failure and joint brake 305B2 is physically disengaged without any time delay.

Since actuator brake 305B1 acts directly on the output of actuator 306B, actuator brake 305B <NUM> can have higher backlash, and lower torque relative to joint brake 305B2 and still control any reaction loads on second link 304B. This is because transmission assembly 307B reduces the effect of the wider tolerances. For example, transmission assembly 307B reduces the amount of backlash by the output reduction of ratio of transmission assembly 207B. For example if the backlash is six degrees and the reduction ratio is <NUM>:<NUM>, the backlash at the output of transmission assembly 307B is <NUM> degrees. For example, transmission assembly 307B increases the torque by the output reduction of ratio of transmission assembly 307B. For example if the brake holding strength is one Newton-meter and the reduction ratio is <NUM>:<NUM>, the holding strength at the output of transmission assembly 307B is <NUM> Newton-meters.

In a computer-aided medical system, the acceptable backlash is determined by determining the amount of movement of the attached instrument due to backlash, and so long as the movement is less than the predetermined acceptable amount. Any backlash that results in the instrument moving less than the predetermined acceptable amount is referred to as low backlash. Backlash is the amount a joint moves with very little load or torque applied. Stiffness determines the amount the joint deflects when more load is applied. For example, an applied force F might cause a joint to deflect an amount x. If the deflection is linear with respect to force, then the stiffness of the joint is k, where k=F/x. In the example of joint assembly <NUM>, joint assembly <NUM> may deflect some small angle due to a torque required to overcome the inertia of entry guide manipulator <NUM>. The higher the stiffness of dual brake assembly <NUM>, the lower the deflection of joint assembly <NUM>. The lower the deflection of joint assembly <NUM>, the lower the amplitude of the vibration at the instrument tips. If the torque is reversing directions, then the total deflection is the sum of the backlash and the deflection due to the compliance (i.e., the inverse of the stiffness) of dual brake assembly <NUM>.

In another aspect, during a procedure, joint brake 305B2 is physically engaged and actuator brake 305B <NUM> is physically engaged. This has two advantages. First, with both brakes engaged, a larger reaction force can be counteracted on second link 304B. Alternatively, it may allow a smaller cheaper brake to be used as joint brake 305B2, because joint brake 305B2 does not need to be configured to counteract the largest anticipated reaction torque/force alone. The second advantage is that if the actuator should fail in an always on state, actuator brake 305B <NUM> is already engaged. Of course, the disadvantage is that actuator 306B cannot be used to move second link 304B during the procedure.

In <FIG>, a system includes a first link 302C (e.g., a proximal link) having a first end portion and a second end portion and a second link 304C (e.g., a distal link) having a first end portion and a second end portion. A joint assembly 303C connects the second end portion of first link 302C and to the first end portion of second link 304C so that second link 304C can be moved relative to first link 302C. Joint assembly 303C includes a joint and a dual brake assembly 305C. The joint is actively controlled by a controller. Dual brake assembly 305C is coupled to first link 302C and to second link 304C. In this example, dual brake assembly 305C is included in joint assembly 303C. However, this is illustrative only and is not intended to be limiting. Dual brake assembly 305C includes two portions, e.g., an actuator brake 305C1 (a first brake) and a joint brake 305C2 (a second brake).

In the example of <FIG>, joint assembly 303C also includes an actuator 306C and a transmission assembly 307C that are configured to move second link 304C relative to first link 302C. The output of actuator 306C is input to transmission assembly 307C. The output of transmission assembly 307C moves second link 304C.

Actuator 306C can be an electric motor, a pneumatic actuator, a hydraulic actuator, etc. Transmission assembly 307C reduces the output of actuator 306C to an output that is suitable for moving second link 304C relative to first link 302C. When actuator 306C is an electric motor, transmission assembly 307C can be, for example, a harmonic drive.

In <FIG>, the housings of actuator brake 305C1, actuator 306C, transmission assembly 307C, and joint brake 305C2 are stationary relative to second link 304C. Joint brake 305C2 is connected to second link 304C, while actuator brake 305C1 brakes the output of actuator 306C. The operation of the components of joint assembly 303C is the same as the corresponding components of joint assembly 303B, and so is not repeated.

<FIG> is a schematic illustration of a passive joint assembly 303D, which does not include an actuator. In <FIG>, a system includes a first link 302D (e.g., a proximal link) having a first end portion and a second end portion and a second link 304D (e.g., a distal link) having a first end portion and a second end portion. Joint assembly 303D connects the second end portion of first link 302D and to the first end portion of second link 304D so that second link 304D can be moved relative to first link 302D. Joint assembly 303D includes a passive joint (an actuator is not used to move the joint) and dual brake assembly 305D. Dual brake assembly is actively controlled by a controller, such as controller <NUM>, while the passive joint is not controlled by a controller.

Dual brake assembly 305D is coupled to first link 302D and to second link 304D. In this example, dual brake assembly 305D is included in joint assembly 303D. However, this is illustrative only and is not intended to be limiting.

Dual brake assembly 305D includes a power-off brake 305D1 (a first brake or a first portion) and a power-on brake 305D2 (a second brake or a second portion). Power-off brake 305D1 is physically engaged, when power is removed from dual brake assembly 305D, and is physically disengaged when power is supplied to dual brake assembly 305D. Power-on brake 305D2 is physically engaged, when power is applied to dual brake assembly 305D, and is physically disengaged, when power is removed from dual brake assembly 305D.

In this aspect, power-on brake 305D2 is configured to provide braking on second link 304D to restrict movement of second link 304D relative to first link 302D in response to reaction loads on second link 304D. Maintaining second link 304D approximately stationary during a procedure using the system minimizes vibration of any device, such as an instrument (e.g., a medical instrument such as a surgical instrument), coupled to the second end portion of second link 304D.

The braking provided by power-on brake 305D2 during a procedure can be as large as necessary to hold second link 304D in place in response to reaction loads, without concern for being able to move second link 304D if a fault condition occurs. Power-on brake 305D2 provides braking, e.g., is physically engaged, so long as a fault condition does not occur. If a fault condition occurs, power-on brake 305D2 is physically disengaged by the controller, and so provides no braking on second link 204B. Thus, when a fault occurs, power-on brake 305D2 does not inhibit movement of second link 304D relative to first link 302D.

Power-off brake 305D1 is configured to restrict movement of second link 304D relative to first link 306D when power is off to the system, when power is off to dual brake assembly 305D, and when a fault condition in the system occurs. The holding strength of power-off brake 305D1 is designed so that the braking allows power-off brake 305D1 to slip when sufficient torque/force is applied to move second link 304D relative to first link 302D. Thus, in a fault condition, dual brake assembly 305D still provides braking, but allows movement of second link 304D relative to first link 302D if sufficient torque/force is applied on second link 304D to cause power-off brake 305D1 to slip.

In <FIG>, a system includes a first link 302E (e.g., a proximal link) having a first end portion and a second end portion and a second link 304E (e.g., a distal link) having a first end portion and a second end portion. A joint assembly 303E connects the second end portion of first link 302E and to the first end portion of second link 304E so that second link 304E can be moved relative to first link 302E. Joint assembly 303E includes a joint and a dual brake assembly 305E. The joint is actively controlled by a controller. Dual brake assembly 305E is coupled to first link 302E and to second link 304E. In this example, dual brake assembly 305E is included in joint assembly 303E. However, this is illustrative only and is not intended to be limiting. Dual brake assembly 305E includes two portions, e.g., a first brake 305E1 and a second brake 305E2.

In the example of <FIG>, joint assembly 303E also includes an actuator 306E and a transmission assembly 307E that are configured to move second link 304E relative to first link 302E. The output of actuator 306E is input to transmission assembly 307E. The output of transmission assembly 307E moves second link 304E.

Actuator 306E can be an electric motor, a pneumatic actuator, a hydraulic actuator, etc. Transmission assembly 307E reduces the output of actuator 306E to an output that is suitable for moving second link 304E relative to first link 302E. When actuator 306E is an electric motor, transmission assembly 307E can be, for example, a harmonic drive.

In <FIG>, the housings of first brake 305E1, actuator 306E, transmission assembly 307E, and second brake 305E2 are stationary relative to first link 302E. Second brake 305E2 and first brake 305E1 both act directly on the output of actuator 306E. The operation of the components of joint assembly 303E is the same as the corresponding components of joint assembly 303B, and so is not repeated. Specifically, even though both second brake 305E2 and first brake 305E1 act on the output of actuator 306E, second brake 305E2 has a larger holding strength (suitable for handling reaction loads) than the holding strength of first brake 305E1 (holding strength limited by egress torque/force needed to make brake slip).

In one aspect, each of the joint brakes and the power-on brake are brakes for rotational joints, and are implemented, for example, using a stationary electromagnet. A brake rotor is attached to flexure, which is then connected a shaft connected to the second link. When electrical power is applied to an electromagnet coil a magnetic field is created. The magnetic force is strong enough to deflect the flexure and pull the brake rotor across a small air gap into a face of the electromagnet. The friction connection between the face of the electromagnet and brake rotor provides a braking force on the shaft. Increasing the current through the electromagnet increases the holding power of the brake. When power is removed from the electromagnet, the flexure pulls the armature across the air gap and away from the face of the electromagnet. With an air gap between the electromagnet and the armature, the shaft of the joint is free to rotate without any residual drag. Alternatively, any electro-mechanical power-on brake could be used so long that brake has the brake holding strength required.

In one aspect, each of the joint brakes acts directly on its joint without an intermediate transmission assembly. This configuration has the advantage that additional compliance from the transmission assembly is eliminated. However, since the torque multiplication factor associated with the transmission assembly is lost, the joint brake is physically larger and heavier (relative to the joint brake that acts through a transmission assembly) so that the joint brake itself can produce the required holding strength.

In one aspect, each of the actuator brakes and each of the power-off brakes is implemented, for example, using a permanent magnet that normally pulls a brake rotor towards a friction surface. The brake rotor is connected to a shaft that is connected to the second link. Friction between the friction surface and the brake rotor stops rotation of the shaft. When power is applied to the brake, a field of an electromagnet cancels the field of the permanent magnet and the rotor is free to move. Reversing the field of the electromagnet strengthens the magnetic to hold the rotor with more torque than the permanent magnet alone. Alternatively, any electro-mechanical power-off brake could be used so long that brake has the brake holding strength required. In another aspect, the brakes are spring-applied brakes, similar to the brake illustrated in <FIG>, but without the variable spring force.

In one aspect, <FIG> is a representative state-diagram for a controller that controls each of the dual brake assemblies described above when implemented in joint assembly <NUM> of computer-aided medical system <NUM>. In this aspect, joint assembly <NUM> is an actively controlled joint assembly. While the states are described as being states of controller <NUM>, the states also are associated with states of dual brake assembly <NUM>. Also, while the states are described with respect to a computer-aided system, this is illustrative only and is not intended to be limiting. The states of the dual brake assembly can be implemented in a wide variety of systems.

Controller <NUM> also can be implemented, as described above. In this example, the first brake of dual brake assembly <NUM> is physically engaged and provides braking whenever power is off to patient side support system <NUM> or when power is off to dual brake assembly <NUM>. The brake holding strength of the first brake restricts motion of second link <NUM> relative to first link <NUM>, but the brake holding strength is such that a user can apply an egress force on second link <NUM>, which produces an egress torque that causes the first brake to slip and so second link <NUM> can be moved. When engaged, the brake holding strength of the second brake restricts movement of second link <NUM> relative to first link <NUM> during a procedure for reaction torques acting on the second link <NUM>.

If a joint actuator fails in an always on state, controller <NUM> detects an actuator always active fault. Also, a fault may occur, power may be turned off to the computer-aided medical system, or power may be turned off to dual brake assembly <NUM>. If an emergency or a fault event occurs, it may be necessary to manually remove instruments from a patient. In such a case, a user must be able to manually move the various links in the computer-aided medical system. If power fails for whatever reason, dual brake assembly <NUM> maintains the position of second link <NUM> relative to first link <NUM> so that motion due to gravity or some other force does not cause any unintended motion. State diagram 400A of controller <NUM> accounts for each of these events.

In a first state <NUM> (a fault/power-off state), the first brake is physically engaged and provides braking to joint assembly <NUM> that is associated with dual brake assembly <NUM>. The second brake is physically disengaged and provides no braking to joint assembly <NUM>. If computer-aided medical system <NUM> is powered off, controller <NUM> is shut down. In first state <NUM>, the brake holding strength of the first brake restricts movement of second link <NUM> relative to first link <NUM>, but the brake holding strength is such that a user or users can apply an egress force on second link <NUM>, which produces an egress torque that in turn causes the first brake to slip, and so second link <NUM> can be moved.

When either power is turned-on or a fault is cleared, controller <NUM> enters second state <NUM>, e.g., the system transitions from first state <NUM> to second state <NUM>. In this example, second state <NUM> is default state. The default state is the state to which the system is switched before use. In this example, with first and second brakes and an actuator that can supply torque, there are three elements with each element having two possible states-physically engaged or physically disengaged. Thus, there are <NUM><NUM>, i.e., eight, possible states that could be selected as the default state. The possible states are presented in Table <NUM>.

One of these eight possible default states, state D8, has all three elements physically disengaged. State D8 is not considered, in this example, for the default state, because in state D8, it is not possible to hold a distal link in any specific position. With the elimination of state D8 as a default state, there are seven possible states that could be used as the default state depending on the configuration and use of the medical system. Thus, in this aspect, any of states D1 to D7 could be selected as the default state so long as the selected default state is consistent with the configuration and use of the medical system.

As an example, state D1 is selected as the default state. This is illustrative only and is not intended to be limiting. As just explained, consistent with the configuration and use of the medical system, any one of the first seven states in Table <NUM> could be selected as the default state.

Returning to <FIG>, in second state <NUM> (a default state in this example), controller <NUM> configures dual brake assembly <NUM> so that the first and second brakes are physically disengaged. Thus, in second state <NUM>, the first and second brakes provide no braking to joint assembly <NUM>. Controller <NUM> commands the actuator in joint assembly <NUM> to restrict movement of second link <NUM> relative to first link <NUM> for reaction torques on second link <NUM>, while in second state <NUM>. Thus, second state <NUM>, in this aspect, is default state D1.

From second state <NUM>, controller <NUM> can transition to several different states. States of interest with respect to joint assembly <NUM> include a third state <NUM> (a clutch state), a fourth state <NUM> (a forward drive state), and a fifth state <NUM> (an entry guide manipulator (EGM) movement state). Controller <NUM> remains in second state <NUM> until an event occurs, which causes controller <NUM> to transition to another state, i.e., one of states <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>. If while in second state <NUM>, a power-off event or a fault event occurs, controller <NUM> transitions from second state <NUM> to first state <NUM>. If the fault event is an actuator always active fault, controller <NUM> does not transition to first state <NUM>, but instead transitions to a sixth state <NUM> (an actuator always active state).

Sixth state <NUM> is shown with a dotted line in <FIG>, because sixth state <NUM> is optional. Sixth state <NUM> would typically not be used in normal operation, because the physical engagement of the first brake nullifies the operation of the actuator. Also, if in fault conditions, power is turned-off to the brakes and actuators, it would not be possible to implement sixth state <NUM> in response to a fault, because sixth state <NUM> assumes that power is available to the brakes and the actuators.

A user may issue a clutch command, which indicates a clutch activation. A user issues the clutch command to be able to freely move the links of computer-aided medical system <NUM>. Alternatively, if the power is being turned on for the first time (a power-on event), a system setup is typically performed, in which the links are moved into position to allow sterile draping of all or part of computer-aided medical system <NUM>. Thus, controller <NUM> transitions from second state <NUM> to third state <NUM> (which in this example is a clutch state), when either a clutch activation event or a set-up start event occurs.

In third state <NUM>, controller <NUM> does not change the configuration of dual brake assembly <NUM>, and so the first and second brakes remain disengaged. The actuator of joint assembly <NUM> is in a neutral state (motion of the joint is neither aided nor restricted by the actuator) and/or compensating for friction to allow motion of the joint in joint assembly <NUM>.

If while in third state <NUM>, a power-off event or a fault event occurs, controller <NUM> transitions from third state <NUM> to a first state <NUM>, which in this example is a fault/power-off state. If the fault event is an actuator always active fault, controller <NUM> does not transition to first state <NUM>, but instead transitions to a sixth state <NUM>. If while in third state <NUM>, a clutch-deactivation event or a setup complete event is received by controller <NUM>, controller <NUM> transitions from third state <NUM> to second state <NUM>.

If while in second state <NUM>, controller <NUM> receives a forward drive event, controller <NUM> transitions from second state <NUM> to a fourth state <NUM>, which in this example is a forward drive state. A forward drive event results from either a command generated by the controller in response to a specified condition (e.g., automatically configuring the EGM for draping or automatically configuring the EGM for transport) or in response to a user command, (e.g., from voice input, gesture input, physical input received at one or more pedals, buttons, touchscreens, or at one or more master input devices at the operator's console). In fourth state <NUM>, both the first and second brakes of dual brake assembly <NUM> remain disengaged, and controller <NUM> commands the actuator in joint assembly <NUM> to follow a position trajectory.

If while in fourth state <NUM>, a power-off event or a fault event occurs, controller <NUM> transitions from fourth state <NUM> to first state <NUM>(fault/power-off state). If the fault event is an actuator always active fault, controller <NUM> does not transition to first state <NUM>, but instead transitions to a sixth state <NUM>. If while in fourth state <NUM>, a forward drive complete event is received by controller <NUM>, controller <NUM> transitions from fourth state <NUM> to second state <NUM>.

If while in second state <NUM>, controller <NUM> receives an entry guide manipulator (EGM) movement event, controller <NUM> transitions from second state <NUM> to a fifth state <NUM>, which is this example is an EGM movement state. An entry guide movement event results from either a command generated by the controller in response to a specified condition (e.g., automatically configuring the EGM for draping) or in response to a user command, (e.g., input received via any appropriate technique, including at one or more master input devices at the operator's console). Several alternative configurations of the first and second brakes of dual brake assembly <NUM> can be used in fifth state <NUM>. In a first alternative, the first brake is disengaged, the second brake is engaged, and actuator commanded torque (torque supplied by the actuator in response to a command from controller <NUM>) is used to hold second link <NUM> stationary (e.g., the actuator and the second brake work together to minimize vibration induced movement of entry guide manipulator <NUM>). Alternately, the first brake is disengaged, the second brake is engaged, and actuator commanded torque is not used. In another alternative, both the first and second brakes are engaged, and actuator commanded torque is not used. In yet another alternative, if the first and second brakes are both joint brakes (e.g., neither brake is an actuator brake), both brakes are engaged and actuator commanded torque is used. (If the first brake is an actuator brake, then engaging the actuator brake while using actuator commanded torque is counterproductive because the actuator brake would fight the actuator commanded torque rather than adding to the actuator commanded torque.

If while in fifth state <NUM>, a power-off event or a fault event occurs, controller <NUM> transitions from fifth state <NUM> to first state <NUM>. If the fault event is an actuator always active fault, controller <NUM> does not transition to first state <NUM>, but instead transitions to a sixth state <NUM>. If while in fifth state <NUM>, an EGM movement complete event is received by controller <NUM>, controller <NUM> transitions from fifth state <NUM> to second state <NUM>.

As indicated above, if a joint actuator fails in an always active state, controller <NUM> detects an actuator always active fault and transitions to an optional sixth state <NUM>. In sixth state <NUM>, sometimes referred to as an actuator always active state <NUM>, controller <NUM> engages the first brake and the second brake of dual brake assembly <NUM>. The first brake brakes the actuator output, and the second brake holds the second link as described previously. If the power is not turned off to dual brake assembly <NUM> in such a case, this is a fault condition and the holding force on the joint is reduced so that dual brake assembly <NUM> can slip when the egress force is applied to second link <NUM>. Thus, after a predetermined time, e.g., a time sufficient for the first brake to be engaged and stop the output of the actuator, controller <NUM> transitions from sixth state <NUM> to first state <NUM>. Similarly, if power to joint assembly <NUM> is turned-off to stop the actuator, controller <NUM> transitions from sixth state <NUM> to first state <NUM>. While it is not shown in <FIG>, if the actuator always active fault is cleared, e.g., controller <NUM> regains control of the actuator within the predetermined time, controller <NUM> transitions from sixth state <NUM> back to second state <NUM>. If a joint is not powered, an actuator is not included in the joint, and so sixth state <NUM> would not be used by the controller.

In another implementation illustrated in <FIG>, sixth state <NUM> is eliminated, and an actuator always active fault is processed the same as any other fault. The first brake in dual brake assembly <NUM> is sized to handle an always active actuator, the other states and transitions between states are the same as described with respect to <FIG>, and so that description is not repeated here.

In the examples of <FIG>, the dual brake assembly is implemented using two different brakes. In <FIG>, the dual brake assembly has two portions with different brake holding strengths, but the two portions are implemented using a single actuator brake. Dual brake assembly <NUM> and dual brake assembly 505A are power-off brakes so that power is applied to disengage the brake.

Dual brake assembly <NUM> is mounted on an actuator <NUM>. A brake rotor <NUM> is rotationally keyed to shaft <NUM> of actuator <NUM>, and brake rotor <NUM> floats axially with respect to shaft502S such that moving caliper <NUM> can push brake rotor <NUM> against stationary caliper <NUM>. Alternatively, if brake rotor <NUM> were also axially fixed to shaft <NUM>, only moving caliper <NUM> would bear on brake rotor <NUM>, and so stationary caliper <NUM> may be eliminated. For the same forces and materials, this would cut the holding strength in half.

When power is off to dual brake assembly <NUM>, a plurality of springs <NUM> forces moving caliper <NUM> against brake rotor <NUM> and towards stationary caliper <NUM>. Stationary caliper <NUM> is coupled to a housing of actuator <NUM>. If power is applied to dual brake assembly <NUM>, an electromagnetic overcomes the force on moving caliper <NUM> from plurality of springs <NUM>, and pulls moving caliper <NUM> away from brake rotor <NUM> so that shaft <NUM> moves freely.

The holding strength of dual brake assembly <NUM> is proportional to the normal force that is applied to brake rotor <NUM> by calipers <NUM>, <NUM>. The normal force is supplied by plurality of springs <NUM> that push moving caliper <NUM> towards brake rotor <NUM>. When dual brake assembly <NUM> is disengaged, the electromagnet creates a force in the opposite direction of the normal force supplied by plurality of spring <NUM> to pull moving caliper <NUM> away from brake rotor <NUM>. The brake holding strength is changed by changing the normal force supplied by plurality of springs <NUM>.

Changing the normal force supplied by plurality of springs <NUM> is achieved, in this aspect, by changing the displacement offset of plurality of springs <NUM>. In dual brake assembly <NUM>, each of plurality of springs <NUM> rests on a different one of a plurality of spring caps <NUM>. Each spring cap rotates about a pivot point 518P. The angular position of each of plurality of spring caps <NUM> is controlled by a controller. The combination of plurality of springs <NUM> and plurality of spring caps <NUM> is one example of a variable load assembly. The variable load assembly is, in this aspect, a variable load spring assembly.

The controller can change the angular positon of each of plurality of spring caps <NUM> about its pivot point. Changing the angular position of a spring cap changes the displacement offset on the associated spring. As shown in <FIG>, each of plurality of spring caps <NUM> is in first position, and the length of each of plurality of springs <NUM> is restricted to the distance between a surface of the corresponding spring cap and a surface of moving caliper <NUM>. In <FIG>, each of plurality of spring caps <NUM> is in second position, and the length of each of plurality of springs <NUM> again is restricted to a different distance between the surface of the corresponding spring cap and the surface of moving caliper <NUM>. The length of the spring in <FIG> is longer than the length of the spring in <FIG>. Stated alternatively, each of plurality of springs <NUM> is compressed more in <FIG> than in <FIG>. Thus, plurality of springs <NUM> provides a larger normal force in <FIG> than in <FIG>, and so the holding strength of dual brake assembly <NUM> is greater for the configuration illustrated in <FIG> than for the configuration illustrated in <FIG>.

In another aspect, one of plurality of spring caps <NUM> is in the first position and a second of the plurality of spring caps <NUM> is in the second positon. With this configuration, a normal force between the normal force of <FIG> and the normal force of <FIG> is obtained.

An advantage of dual brake assembly <NUM> is that finer adjustments in the normal force can be achieved and so finer adjustments of the holding strength can be achieved relative to prior art single brake configurations. Depending on the angular position of plurality of spring caps <NUM>, plurality of springs 517would have different displacements and would create different normal forces. The spring force is generally linear with deflection or a change in airgap, while the force from am electromagnet is not. Therefore, a spring applied brake can be more easily be configured to apply a specific force or torque, and a spring applied brake is less susceptible to variation in holding strength due to tolerance stack-up in the various components which make up the brake assembly than an electromagnetically applied brake.

Dual brake assembly 505A is equivalent to dual brake assembly <NUM>, except plurality of spring caps <NUM> has been replaced with a plurality of cam assemblies 518A. As each cam assembly rotates, the displacement of the spring resting on the same changes, and so the brake holding strength of dual brake assembly changes. The combination of plurality of springs <NUM> and plurality of cam assemblies 518A is another example of a variable load assembly.

<FIG> is a cut-away illustration of one implementation of joint assembly <NUM> with a dual brake assembly <NUM>. Dual brake assembly <NUM> includes an actuator brake 605A and a joint brake 605B. Joint assembly <NUM> is mounted on first link <NUM> and allows second link <NUM> to be moved relative to first link <NUM>.

Joint assembly <NUM> further includes an actuator, which is an electric motor, and a transmission assembly, which is harmonic drive <NUM>. The electric motor includes motor stator windings <NUM>, motor rotor magnets <NUM>, a motor bearing <NUM>, and a shaft <NUM>.

Joint assembly <NUM> also includes a joint absolute position sensor <NUM>, a motor position sensor <NUM>, and joint bearings <NUM>. In this aspect, joint bearings <NUM> are tapered roller bearings.

Joint brake 605B includes an electromagnetic coil <NUM> and a moving armature <NUM>. A flexure <NUM> connects armature <NUM> to hub <NUM>. Hub <NUM> is fixed to second link <NUM>.

Actuator brake 605A is a motor brake 605A that brakes the electric motor comprising the actuator of joint assembly <NUM>. Motor brake 605A includes an electromagnet coil <NUM>, a moving caliper <NUM>, a stationary caliper <NUM>, and a brake rotor <NUM>. Brake rotor <NUM> is keyed to motor shaft <NUM>. Springs that push on moving caliper <NUM> to sandwich brake rotor <NUM> between the two calipers when no power is applied are not visible in <FIG>.

Although some of the examples described herein refer to surgical procedures or tools, or medical procedures and medical tools, the techniques disclosed apply to medical and non-medical procedures, and to medical and non-medical tools. For example, the tools, systems, and methods described herein may be used for non-medical purposes including industrial uses, general robotic uses, and sensing or manipulating non-tissue work pieces. Other example applications involve cosmetic improvements, imaging of human or animal anatomy, gathering data from human or animal anatomy, setting up or taking down the system, and training medical or non-medical personnel. Additional example applications include use for procedures on tissue removed from human or animal anatomies (without return to a human or animal anatomy), and performing procedures on human or animal cadavers. Further, these techniques can also be used for medical treatment or diagnosis procedures that include, or do not include, surgical aspects.

In some of the above examples, the terms "proximal" or "proximally" are used in a general way to describe an object or element which is closer to a manipulator arm base along a kinematic chain of system movement or farther away from a remote center of motion (or a surgical site) along the kinematic chain of system movement. Similarly, the terms "distal" or "distally" are used in a general way to describe an object or element which is farther away from the manipulator arm base along the kinematic chain of system movement or closer to the remote center of motion (or a surgical site) along the kinematic chain of system movement.

As used herein, "first," "second," "third," "fourth," etc. are adjectives used to distinguish between different components or elements. Thus, "first," "second," "third," "fourth," etc. are not intended to imply any ordering of the components or elements.

The above description and the accompanying drawings that illustrate aspects and embodiments of the present inventions should not be taken as limiting-the claims define the protected inventions. Various mechanical, compositional, structural, electrical, and operational changes may be made without departing from the scope of the claims. In some instances, well-known circuits, structures, and techniques have not been shown or described in detail to avoid obscuring the invention.

Further, this description's terminology is not intended to limit the invention. For example, spatially relative terms-such as "beneath", "below", "lower", "above", "upper", "proximal", "distal", and the like-may be used to describe one element's or feature's relationship to another element or feature as illustrated in the figures. These spatially relative terms are intended to encompass different positions (i.e., locations) and orientations (i.e., rotational placements) of the device in use or operation in addition to the position and orientation shown in the figures. For example, if the device in the figures is turned over, elements described as "below" or "beneath" other elements or features would then be "above" or "over" the other elements or features. Thus, the exemplary term "below" can encompass both positions and orientations of above and below. Likewise, descriptions of movement along and around various axes include various special device positions and orientations.

The various controllers described herein can be implemented by software executing on a processor, hardware, firmware, or any combination of the three. When the controllers are implemented as software executing on a processor, the software is stored in a memory as computer readable instructions and the computer readable instructions are executed on the processor. All or part of the memory can be in a different physical location than a processor so long as the processor can be coupled to the memory. Memory refers to a volatile memory, a non-volatile memory, or any combination of the two.

Also, the functions of the various controllers, as described herein, may be performed by one unit, or divided up among different components, each of which may be implemented in turn by any combination of hardware, software that is executed on a processor, and firmware. When divided up among different components, the components may be centralized in one location or distributed across the system for distributed processing purposes. The execution of the various controllers results in methods that perform the processes described above for the various controllers.

A processor is coupled to a memory containing instructions executed by the processor. This could be accomplished within a computer system, or alternatively via a connection to another computer via modems and analog lines, or digital interfaces and a digital carrier line, or via connections using any of the protocols described above. In view of this disclosure, instructions used in any part of or all of the processes described herein can be implemented in a wide variety of computer system configurations using an operating system and computer programming language of interest to the user.

Claim 1:
A system comprising:
a first link (<NUM>) having a first end portion and a second end portion;
a second link (<NUM>) having a first end portion and a second end portion;
a joint (<NUM>) connected to the second end portion of the first link and to the first end portion of the second link (<NUM>); and
a dual brake assembly (<NUM>) coupled to the first link (<NUM>) and to the second link (<NUM>), wherein the dual brake assembly (<NUM>) includes a first brake (305B1, 305C1, 305D1, 305E1) and a second brake (305B2, 305C2, 305D2, 305E2),
wherein:
braking the dual brake assembly (<NUM>) reduces relative motion between the first and second links (<NUM>, <NUM>),
the first brake (305B1, 305C1, 305D1, 305E1) provides a first brake holding strength when physically engaged,
the second brake (305B2, 305C2, 305D2, 305E2) provides a second brake holding strength when physically engaged,
the first brake (305B1, 305C1, 305D1, 305E1) is configured to physically engage when power is removed from the dual brake assembly (<NUM>),
the second brake (305B2, 305C2, 305D2, 305E2) is configured to physically disengage when the power is removed from the dual brake assembly (<NUM>), and
the second brake holding strength is different from the first brake holding strength.