Escolar Documentos
Profissional Documentos
Cultura Documentos
1. Introduction:
Pasquale Sessa
ABSTRACT:
The kidneys are responsible for filtering waste products from the blood. The dialysis is a procedure to replace the renal (kidney) function through
Haemodialysis machine in people who suffer from
end stage renal disease. Haemodialysis machine
provide the fluids of dialysis for the cleaning of
the patients blood and removal of excess fluid.
One aspect to take care in the development of a
dialysis machine is the alarm system. Alarm systems
are important for safe and efficient operation of
many technical systems. However, it is vital that the
design of the alarms and the alarm system matches
the conditions and needs of the human operator.
During treatment multiple alarm can occur but
we must ensure that the alarm must be accurate, intuitive, and provide alerts which are readily interpreted. Audible alarms serve multiple functions in medical equipment, not
the least of which is that they protect
manufacturers against liability. This article is offered as to facilitate the improvement of alarm design; on the other hand give some tips to develop
alarm uniformity. In order to accomplish this, it is
necessary to approach the management of alarm
troubleshooting in a systematic manner. The title
of the article refers to the IEC 60601-1-8, a comprehensive international standard that specifies basic safety and essential performance requirements
and tests for alarm systems in medical equipment.
Medical equipment manufacturers usually develop
proprietary alarms for their products. Efforts to harmonize alarm systems in medical equipment had
been moving slowly over the last decade. As device makers continue to integrate more functions
into each piece of medical equipment, they must
also incorporate more types of warning sounds.
16
system we must remember that is needed to interact clearly with the hardware and mechanical parts
of the system and comply with the regulation the
machine state at the alarm activation is a safe state in the shortest possible time. However, in some
applications such as medical equipment, a persons
life may depend upon the audible warning sound.
In all cases, the equipment designer should consider the desired characteristics of the audible alarm
at the initial design planning phase to obtain satisfactory performance and avoid costly redesign. The
first characteristic for a designer to consider is the
type of sound such as a continuous, intermittent, or
specialty sound. Other critical criteria include sound
level, frequency, current draw, quality, mounting
configuration, cost, and availability.
Even in this case the standard IEC 60601-1-8 comes
to the rescue, defined visual and audible alarm characteristics.
2. Methods: Determining Priority
Inadequate configuration and use of the alarm systems lead to unnecessary alarms on the one hand
and also result in critical situations not detected on
the other hand. Therefore, a higher general awareness, and increased knowledge, of healthcare providers regarding the function of the alarm system is of
interest. Determining serious injury of the patient,
probably could understand the exactly classification
of visual alarm of the medical device. For determining serious injury we start to study the typical symptoms and sign of patient. In the chronic renal therapy typical symptoms and signs of injury are:
- Breath
- Nausea
- First use syndrome
- Feel hot
- Feel funny
- Restless
- Headache
probably these list of sign required immediate first
aid to prevent serious injury and to mitigate the serious injury the machine raises an alarm. IEC 606011-8 gives guidance on whether a patients condition
should be assigned a high, medium or low priority.
This guidance is based on the potential result of a
failure to respond to the cause of the alarm condition and how fast the potential harm could happen
to the patient. The alarm signals priority is the following:
- low priority: operator awareness required;
- medium priority: prompt operator response required;
- high priority: immediate operator response required;
- reminder signal: if alarms are inactive;
- information signal: other than above and unlikely to be covered by the standard.
17
be classified as following:
a- Onset of potential harm refers to when an
injury occurs and not to when it is manifested;
b- Having the potential for the event to develop
within a period of time not usually sufficient for
manual corrective action;
c- Having the potential for the event to develop
within a period of time usually sufficient for manual corrective action;
d- Having the potential for the event to develop
within an unspecified time greater than that given under prompt.
In the following Table 1 the values present in the
cells represent an example of alarm priority table
that follows the previous (a) , (b), (c), (d) reasons:
In the interface of the dialysis system figure (see Figure 1) all the interface are shown graphically. One
higherlevel interface is the graphical user interface
used by the medical staff supervising the dialysis
process. The user interface allows for the setting of
the operational values, e.g. dialysis fluid temperature and dialysis process characteristics, and provides
accurate information about the system operation.
Especially in case of alarm situations, the system
should provide up-to-date information and allow for
quick and accurate operation. Finally, the second higherlevel supports the interaction with medical information systems. This allow for the downloading
of the patient information, including patient specific
settings of the dialysis parameters.
A first point of view of the alarms classification
we should distinguish between the alarms of the
dialysis fluid circuit and the extra-corporal circuit.
In this case we separate circuits, because extra-corporal circuit is more highly prioritized for patient
safety than the dialysis fluid. This choice is correct
because during the alarms condition related to the
fluid the machine goes in bypass state, safe state
of the patient. But however an information signal
may also be used to indicate the potential result of
failure to respond in case of delayed or prompt or
immediate potential harm of the patient. The potential result of failure to respond of the nurse could
Potential
result of failure to respond
Immediate (b)
(within seconds
to a couple of
minutes)
Prompt (c)
Delayed (d)
(at least several
(many minutes
to many minutes to hours)
have elapsed)
Death or
irreversible
injury
HIGH (a)
MEDIUM
MEDIUM
Reversible
injury
HIGH
MEDIUM
LOW
Minor injury
or discomfort
HIGH
MEDIUM
LOW
Immediate
(within seconds
to a couple of
minutes)
Prompt
Delayed
(at least several
(many minutes
to many minutes to hours)
have elapsed)
Death or
irreversible
injury
HIGH
MEDIUM
MEDIUM
Reversible
injury
HIGH
MEDIUM
LOW
Minor injury
or discomfort
HIGH
MEDIUM
LOW
18
Alarm
category
Indicator
colour
Flashing
frequency
High
priority
Red
Medium
priority
Yellow
0,4Hz to 0,8 Hz
20% to 60%
on
Low
priority
Cyan or
yellow
Constant (on)
100% on
Duty Cycle
(on/off time)
19
It is acceptable to have a single visual alarm indicator if it meets all applicable requirements.
The guidance on visual signals advices to not use
flashing text, because is difficult to read so should
avoid. In case of the black text on white background
or white text on black background the use of flashing
text is allowed. We are needed of the audible and visual alarm system above all:
- when alarm system is in proximity of other
alarm system (i.e. in ER);
- not needed when worn (i.e. pager);
- as dictated by risk analysis.
The work involving human-machine interaction is
complex, but is essential in the medical device development. In fact there is no doubt that there is
a need for major research and development efforts
for medical device alarm systems to ensure easy
human-machine interaction to improve user greater
satisfaction. The entire chain, starting with the selection of appropriate alarm settings for a patient,
continuing with the signal acquisition and ending
with the communication of the alarm message,
needs to be carefully examined. The IEC 60601-1-6
(Usability) should be used when designing and must
be used to validate visual signals:
- meaning will be understood;
- priority will be recognized;
- location and required action will be understood.
20
Characteristic
Value
PULSE FREQUENCY(f0)
150 Hz to 1,000 Hz
Number of harmonic
components in the
range 300 Hz to 4000 Hz
Not applicable
Not applicable
INTERBURST
INTERVAL (b,
c) (td)
2.5 s to
15.0 s
2.5 s to
30.0 s
>15 s or no
repeat
Difference
in amplitude
between any
two PULSES
Maximum
10 db
Maximum
10 db
Maximum
10 db
Minimum of 4
Effective PULSE duration
(td)
HIGH PRIORITY
75 ms to 200 ms
125 ms to 250 ms
10% - 20% of td
tf < ts tr
MEDIUM
PRIORITY
SIGNAL
LOW PRIORITY
SIGNAL (d)
Number of
PULSES in
BURST (a,e)
10
1 or 2
Between
1st and 2nd
PULSE
Characteristic
Between 9th
and 10th
PULSE
Between 2nd
and 3rd PULSE
Not applicable
Between 3rd
and 4th PULSE
2x+td
Not applicable
Not applicable
Between 4th
and 5th PULSE
Not applicable
Not applicable
Between 5th
and 6th PULSE
0.35 s to
1.30 s
Not applicable
Not applicable
Between 6th
and 7th PULSE
x
Not applicable
Not applicable
Between 7th
and 8th PULSE
x
Not applicable
Not applicable
Between 8th
and 9th PULSE
2x+td
Not applicable
Not applicable
Between 9th
and 10th
PULSE
x
Not applicable
Not applicable
c-Manufacturers are encouraged to use the longest INTERBURST INTERVAL consistent with the risk analysis. Writers
of particular standards are encouraged to consider the
longest appropriate INTERBURST the auditory ALARM SIGNAL for the particular ALARM SYSTEM application. Long
INTERBURST INTERVAL can under certain conditions negatively affect the ability to correctly discern, in a timely
manner, the source of the ALARM CONDITION.
d-The generation of the auditory component of a LOW PRIORITY ALARM CONDITION is optional.
e-Unless inactivated by the OPERATOR, MEDIUM PRIORITY
and LOW PRIORITY auditory ALARM SIGNALS shall complete at least one BURST, and HIGH PRIORITY auditory ALARM
SIGNALS shall complete at least half of one BURST.
21
Figure 3. Representation of
the signal in the time domain.
Description
ALARM SIGNAL GENERATION
DELAY OF DISTRIBUTED
ALARM SYSTEM, maximum
time or time to TECHNICAL
Clause or
subclause
201.4.2 b)
ALARM CONDITION
ALARM SIGNAL
GENERATION DELAY,
mean
201.4.1
ALARM SIGNAL
GENERATION DELAY,
statistics of distribution
201.4.1
201.4.1
201.4.1
201.12 b)
201.12 c)
201.1.1
201.1.2
Just for clarification but in this article does not deepen the discourse the clause 6 of the standard highlights some rules to consider and to clarify in the
instruction for use:
overview of alarm system;
description of every possible alarm and, as appropriate for the user, how it is determined;
inherent delays;
expected operator position;
how and when to verify alarm functionality;
caution against setting extreme limits.
22
To end the overview of the audible alarm characteristic by standard is important to add some notes
on melodies and Annex EEE. Meaning of melody is
required to be consistent with the underlying alarm
condition or equipment category and may be used
only to indicate the defined conditions. Melodies
other than those defined are acceptable if they cannot be confused with the defined melodies, or the
defined alarm signals.
The standard defines generic melody for general
use as following:
Cause
Any
Low Priority
ec
The characters c,d,e,f,g,a,d,C refer to relative musical pitches and C is one octave above c.
An examples of the different melody are represented in the following table:
Cause
Medium Priority
High Priority
General
ccc
ccccc
Cardiac
ceg
ceggC
Artificial
perfusion
c f# c
c f# c c f#
Ventilation
caf
cafaf
Oxygen
Cba
Cbagf
Temp/Energy
delivery
cde
cdefg
Drug or fluid
delivery
Cdg
Cdg- Cd
Equipment or
supply failure
Ccc
CccCc
The IEC 60601-2-16/ IEC 60601-1-8 standards impose some constraints on the sound pulses that build up an alarm sound, in terms of length, duration,
rise/fall time, spectral content and sound power.
We not expand on the frequency speech in this article, but say that the sound of the alarm requires
testing to be compliant to IEC 60601-1-8. According
the standard the audio file (high, medium, low) from
a spectral point of view, must be a minimum of 4
pulse harmonics in the range from 300 Hz to 4kHz,
the fundamental frequency of the pulses must lie
between 150 Hz and 1kHz, and the 4 harmonics
must have an amplitude between +/- 15 dB from the
fundamental.
3. A Software approach of intelligent alarm
system
The clause 201.2 describes intelligent alarm as:
alarms threshold changes over time;
determines an alarm condition (multiple variables, algorithms, fuzzy logic, etc.);
generates signals for multiple conditions of
equal priority (ranking, effect on signal generation, etc.);
changes delays (in recognition of or generation
of alarm);
changes alarm signal characteristics (volume,
pitch, etc.);
The intelligent alarm system is a quite complex piece of software and are characterized by a higher
degree of different functionality. It determines the
different alarm condition and manages the different
condition to raise an alarm. It has a graphical user
interface to a dialysis machine and is able to describe generic information data using different kinds of
widgets. Essentially the three major software subsystems are the General User Interface (GUI), the Control System, and the Protective System (see figure 5).
23
24
The protect system monitoring process independently from other subsystem. If we think at the alarm
monitoring process as a device that is monitoring by
a second device (like supervisor), the Alarm Detector
Device becomes a single atomic module, which is
configured with a number of device-specific alarm
situations has arisen. If it identifies an alarm situation, it invokes the associated Alarm Handler which
then takes care of the alarm. The alarm detector device also is part of hierarchy of devices. If we want
to obtain major abstraction on the Device/Control
relations, the Alarm Detector Device represents a
specialization of the Device archetype. Components
of the Alarm Detector Device archetype is responsible for monitoring the sub devices and make sure
the value read from the sensors are within the alarm
threshold value set to the Alarm Detector Device.
When threshold limits are crossed an Alarm Handler
component is invoked. The Alarm Handler is the archetype responsible for responding to alarms by returning the haemodialysis machine to a safe-state or
by addressing the cause of the alarm. Components
are used to parameterize the Alarm Detector Device
components (see figure 7).
The control system may utilize Alarm Detector Device to detect problem situations. Assuming this type
of architecture the protective subsystem is modeled
as a device hierarchy. In this case the entities related
to the hardware are modeled and complete system
is easily interchangeable. Also is possible to define
different controlling algorithm for every device. The
device becomes either a leaf device or a logical device.
Each controlling algorithm with a normalize represent a parameterized leaf device while more sub
devices with the controlling algorithm and the normalizer object represents a logical device. The device archetype stores the information relations and
configuration about controlling algorithm while the
controlling algorithm performs calculation for setting values of sub output device. The controlling algorithm gets values from input sub devices and the
control receives the value from encapsulated device.
So the computation is done in a separate archetype,
which is used to parameterize device components.
The object Normalizer is used to bring or make into
the same units values different units of measurement. Also a normalization archetype is used to parameterize the device components and as interface
for the different input values. The previous archetype may use to model the application architecture of
a haemodialysis machine (see figure 8).
This point of view represents the system with a layered view. The GUI subsystem is represented with
Haemodialysis Machine (HDF) treatment, while the
remains other components is in dashed region (Protective System in red, Control System in blue, Control
Hardware System in azure). The access to the device
25
CONCLUSIONS
GLOSSARY
26
Biography
Pasquale Sessa,
BIBLIOGRAPHY
[1].
IEC 60601-1-8 Ed. 1.0 b:2005,
Medical electrical equipment
- Part 1-8: General requirements for safety
- Collateral Standard: General requirements,
equipment and medical electrical systems
Standard IEC 60601-1-8, 2006
[2].
ISO 3864-2:2004, Graphical symbols
- Safety colours and safety signs
- Part 2: Design principles for product safety labels
Standard ISO 3864-2:2004
[3].
The International Organization for Standardization
http://www.iso.org
[4].
Dan OBrien, Outside Sales Engineer, Mallory
Sonalert Products, Inc.Using Audible Alarms in Medical Equipment (IEC 60601-1-8)
[5].
Wirfs-Brock, B. Wilkerson, L. Wiener, Designing Object-Oriented Software, Prentice Hall, 1990.
[6].
J. Rumbaugh, M. Blaha, W. Premerlani, F.
Eddy, W. Lorensen Object-oriented modeling and
design, Prentice Hall, 1991
[7].
Jan Bosch Design and use of software archi-
27