CONTROL SYSTEM FOR SURGICAL ROBOT SYSTEM WITH SAFETY MONITOR

BACKGROUND

[0001] It is known to use robots for assisting and performing surgery. FIG. 1 illustrates an example surgical robot system 100 comprising a surgical robot 102 which consists of a base 104, an arm 106, and an instrument 108. The base 104 supports the robot, and is itself attached rigidly to, for example, the operating theatre floor, the operating theatre ceiling or a trolley. The arm 106 extends between the base 104 and the instrument 108. The arm 106 is articulated by means of multiple flexible joints 110 along its length, which are used to locate the surgical instrument in a desired location relative to the patient. The surgical instrument is attached to the distal end 112 of the robot arm. The surgical instrument penetrates the body of the patient 114 at a port 116 so as to access the surgical site. At its distal end, the instrument comprises an end effector 118 for engaging in a medical procedure.

[0002] The surgical robot 102 is controlled remotely by an operator (e.g. surgeon) via an operator console 120 that may be located in the same room (e.g. operating theatre) as the surgical robot 102 or remotely from it. The operator console 120 may comprise input devices 122, 124 for controlling the state of the arm 106 and/or instrument 108 attached thereto. The input devices 122, 124 may be, for example, handgrips or hand controllers (e.g. one for each hand), with one or more buttons thereon, mounted on parallelogram linkages. The operator console 120 may also comprise a display 126. The display 126 may be arranged to be visible to an operator (e.g. surgeon) operating the input devices 122, 124. The display 126 may be used to display a video stream of the surgical site (e.g. a video stream captured by an endoscope, and/or a video stream captured another camera or microscope (such as those used in open surgery)) and/or other information to aid the operator (e.g. surgeon) in performing the surgery. The display may be two-dimensional (2D) or three-dimensional (3D).

[0003] A control system 128 converts the movement of (and actions performed on/via) the input devices into control signals to move the arm joints and/or instrument end effector of the surgical robot. In some cases, the control system 128 is configured to generate control signals to move the arm joints and/or instrument end effector based on the position in space of the input devices and their orientation.

[0004] Although the example surgical robot system of FIG. 1 comprises a single surgical robot, in other examples, a surgical robot system may comprise a plurality of surgical robots.

For example, FIG. 2 illustrates a surgical robot system 200 with multiple robots 202, 204, 206 operating in a common workspace on a patient 208.

[0005] As a surgical robot system 100, 200 is used to perform a surgical procedure on a patient it is important the component or elements of the system communicate with each other as expected and that the control system 128 issues accurate command to the surgical robot arm(s) in light of the state of the surgical robot arm(s) and the other components of the system, and the inputs received from the input devices. If the system is not operating as expected there can be severe, if not, catastrophic consequences. Accordingly, it may be desirable to implement one or more safety mechanisms which are able to determine if there is a fault with the surgical robot system, and the control system 128 in particular, and if a fault is detected, put the system, or one or more components of the system, into a safe state.

[0006] The embodiments described below are provided by way of example only and are not limiting of implementations which solve any or all of the disadvantages of known surgical robot system and/or method of controlling a surgical robot system.

SUMMARY

[0007] This summary is provided to introduce a selection of concepts that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0008] Described herein are control system and method for controlling a surgical robot system, the surgical robot system comprising at least one surgical robot, each of the at least one surgical robot comprising a base, and an arm extending from the base to an attachment for an instrument, the arm comprising a plurality of joints whereby the configuration of the arm can be altered. The control systems comprising: a main controller configured to: receive communications from one or more devices of an operator console identifying inputs from an operator of the at least one surgical robot; generate control signals for controlling the movement of the at least one surgical robot arm based on the inputs; and send communications to the at least one surgical robot identifying the control signals; and a safety monitor configured to analyse at least a portion of the communications to and/or from the main controller to determine whether the surgical robot system is in a fault state, and in response to determining that the surgical robot system is in a fault state, cause at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state.

[0009] A first aspect provides a control system for controlling a surgical robot system, the surgical robot system comprising at least one surgical robot, each of the at least one surgical robot comprising a base, and an arm extending from the base to an attachment for an instrument, the arm comprising a plurality of joints whereby the configuration of the arm can be altered, the control system comprising: a main controller configured to: receive communications from one or more devices of an operator console identifying inputs from an operator of the at least one surgical robot; generate control signals for controlling the movement of the at least one surgical robot arm based on the inputs; and send communications to the at least one surgical robot identifying the control signals; and a safety monitor configured to analyse at least a portion of the communications to and/or from the main controller to determine whether the surgical robot system is in a fault state, and in response to determining that the surgical robot system is in a fault state, cause at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state.

[0010] The safety monitor may be configured to cause the at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state by causing communications between the at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller to be blocked.

[0011] The safety monitor may be configured to cause the at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state by causing a safety device to filter communications between the at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller.

[0012] The safety monitor may be configured to cause the safety device to filter communications between the at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller by writing information to at least one register of a set of registers that indicates to the safety device that communication at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller is to be filtered.

[0013] The control system may further comprise the safety device.

[0014] The safety device may be configured to receive communications to and from the main controller and provide a copy of at least a portion of the communications to and from the main controller to the safety monitor.

[0015] The at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller that are transitioned to a safe state may be based on a type of fault state determined.

[0016] The safety monitor maybe configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller that the control signals for controlling the movement of the surgical robot arm cause the surgical robot arm to move to a position that is inconsistent with a current state of the surgical robot arm and/or the inputs from the operator.

[0017] The safety monitor may be configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communication to and/or from the main controller, that a frequency of communications from at least one of the one or more devices of an operator console and the surgical robot to the main controller is below a predetermined threshold or the frequency of communication from the main controller to at least one of the one or more devices of an operator console and the surgical robot is below a predetermined threshold.

[0018] The safety monitor may be configured to determine that the surgical robot system is in a fault state if the safety monitor detects from the communication to and/or from the main controller that at least one of the one or more devices of the operator console and the surgical robot is running software that is not compatible with the main controller.

[0019] The at least one surgical robot may comprise a plurality of surgical robots and each of the plurality of surgical robots is allocated a unique identifier, and the safety monitor may be configured to determine that the surgical robot system is in a fault state if the safety monitor detects that at least two of the surgical robot arms send communications indicating they are allocated the same unique identifier.

[0020] The at least one surgical robot may comprise a plurality of surgical robots and each of the plurality of surgical robots is allocated a unique identifier and the allocated unique identifier is displayed on a display of the operator console, and the safety monitor may be configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that a surgical robot arm is reporting a unique identifier that does not match the unique identifier displayed on the display.

[0021] The safety monitor may be configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that control signals for control the movement of the surgical robot cause the arm of the surgical robot to move between a first position and a second position, wherein moving between the first and second position would cause the arm of the surgical robot to exceed a maximum speed.

[0022] A second aspect provides a method of a surgical robot system is in a fault state, the surgical robot system comprising at least one surgical robot, each of the at least one surgical robot comprising a base, and an arm extending from the base to an attachment for an instrument, the arm comprising a plurality of joints whereby the configuration of the arm can be altered, the main controller configured to the method comprising: receiving, at a safety monitor, at least a portion of communications to and/or from a main controller of the surgical robot system, the main controller configured to receive communications from one or more devices of an operator console identifying inputs from an operator of the at least one surgical robot, generate control signals for controlling the movement of the at least one surgical robot arm based on the inputs, and send communications to the at least one surgical robot identifying the control signals; analyse, at the safety monitor, the at least a portion of communications to and/or from the main controller to determine if the surgical robot system is in a fault state; and in response to determining that the surgical robot system is in a fault state, cause at least one of the one or more devices of an operator console and at least one surgical robot to transition to a safe state.

[0023] The above features may be combined as appropriate, as would be apparent to a skilled person, and may be combined with any of the aspects of the examples described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Examples will now be described in detail with reference to the accompanying drawings in which:

[0025] FIG. 1 is a schematic diagram of an example surgical robot system comprising a surgical robot, an operator console and a control system;

[0026] FIG. 2 is a schematic diagram of an example surgical robot system comprising a plurality of surgical robots;

[0027] FIG. 3 is a block diagram of an example control system for a surgical robot system;

[0028] FIG. 4 is a schematic diagram of an example surgical robot arm;

[0029] FIG. 5 is a block diagram of an example implementation of the safety device of FIG. 3 which comprises Tx and Rx filters;

[0030] FIG. 6 is a block diagram of an example implementation of the Tx and Rx filters of FIG. 5;

[0031] FIG. 7 is a flow diagram of an example method of selectively filtering communications to and/or from the main controller of FIG. 3, which may be implemented by the safety device of FIG. 3;

[0032] FIG. 8 is a block diagram of an example implementation of the safety monitor of FIG.

3;

[0033] FIG. 9 is a flow diagram of an example method of monitoring the communications to and from the main controller to detect a fault in the system, which may be implemented by the safety monitor of FIG. 8; and

[0034] FIG. 10 is a schematic diagram illustrating a virtual pivot point of a port.

[0035] The accompanying drawings illustrate various examples. The skilled person will appreciate that the illustrated element boundaries (e.g., boxes, groups of boxes, or other shapes) in the drawings represent one example of the boundaries. It may be that in some examples, one element may be designed as multiple elements or that multiple elements may be designed as one element. Common reference numerals are used throughout the figures, where appropriate, to indicate similar features.
CLAIMS

1 . A control system (306) for controlling a surgical robot system (300), the surgical robot system (300) comprising at least one surgical robot (302, 400), each of the at least one surgical robot (302, 400) comprising a base (404), and an arm (402) extending from the base (404) to an attachment (406) for an instrument (408), the arm (402) comprising a plurality of joints (410) whereby the configuration of the arm (402) can be altered, the control system (306) comprising:

a main controller (312) configured to:

receive communications from one or more devices of an operator console identifying inputs from an operator of the at least one surgical robot;

generate control signals for controlling the movement of the at least one surgical robot arm based on the inputs; and

send communications to the at least one surgical robot identifying the control signals; and

a safety monitor (316) configured to:

analyse (i) at least a portion of the communications from the one or more devices of the operator console to the main controller, and (ii) at least a portion of the communications from the main controller to the at least one surgical robot (312), to independently verify that each of one or more of the main controller, the one or more devices of the operator console and the at least one surgical robot are operating as expected;

determine, based on the analysis, whether the surgical robot system (300) is in a fault state; and

in response to determining that the surgical robot system (300) is in a fault state, cause at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state.

60

AMENDED SHEET (ARTICLE 19)

The control system (306) of claim 1 , wherein the safety monitor (316) is configured to cause the at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state by causing communications between the at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller (312) to be blocked.

The control system (306) of any preceding claim, wherein the safety monitor is configured to cause the at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state by causing a safety device (314) to filter communications between (i) the at least one of the one or more devices of the operator console and the at least one surgical robot, and (ii) the main controller (312).

The control system (306) of claim 3, wherein the safety monitor (316) is configured to cause the safety device (314) to filter communications between (i) the at least one of the one or more devices of the operator console and the at least one surgical robot, and (ii) the main controller (312) by writing information to at least one register of a set of registers that indicates to the safety device (314) that the communications between (i) the at least one of the one or more devices of the operator console and the at least one surgical robot, and (ii) the main controller (312) is to be filtered.

The control system (306) of claim 3 or claim 4, further comprising the safety device (314).

The control system (306) of claim 5, wherein the safety device (314) is configured to receive communications to and from the main controller (312) and provide a copy of at least a portion of the communications to and from the main controller (312) to the safety monitor (316).

The control system (306) of any preceding claim, wherein the at least one of the one or more devices of the operator console and the at least one surgical robot are transitioned to a safe state are based on a type of fault state determined.

The control system (306) of any preceding claim, wherein the safety monitor (316) is configured to determine that the surgical robot system (300) is in a fault state if the safety monitor (316) detects, from the communications to and/or from the main controller (312), that the control signals for controlling the movement of at least one of the at least one surgical robot arm cause that surgical robot arm to move to a position

61

AMENDED SHEET (ARTICLE 19)

that is inconsistent with a current state of that surgical robot arm and/or the inputs from the operator.

The control system (306) of any preceding claim, wherein the safety monitor (316) is configured to determine that the surgical robot system (300) is in a fault state if the safety monitor (316) detects, from the communication to and/or from the main controller (312), that a frequency of communications from at least one of the one or more devices of an operator console and the at least one surgical robot to the main controller is below a predetermined threshold or that a frequency of communication from the main controller to at least one of the one or more devices of an operator console and the at least one surgical robot is below a predetermined threshold.

The control system (306) of any preceding claim, wherein the safety monitor (316) is configured to determine that the surgical robot system (300) is in a fault state if the safety monitor (316) detects, from the communications to and/or from the main controller (312), that at least one of the one or more devices of the operator console and the at least one surgical robot is running software that is not compatible with the main controller (312).

The control system (306) of any preceding claim, wherein the at least one surgical robot comprises a plurality of surgical robots and each of the plurality of surgical robots is allocated a unique identifier, and the safety monitor (316) is configured to determine that the surgical robot system (300) is in a fault state if the safety monitor (316) detects, from the communications to and/or from the main controller (312), that at least two of the surgical robots send communications indicating that they are allocated the same unique identifier.

The control system (306) of any preceding claim, wherein the at least one surgical robot comprises a plurality of surgical robots, and each of the plurality of surgical robots is allocated a unique identifier and the allocated unique identifier is displayed on a display of the operator console, and the safety monitor (316) is configured to determine that the surgical robot system (300) is in a fault state if the safety monitor (316) detects, from the communications to and/or from the main controller (312), that surgical robot of the plurality of surgical robots is reporting a unique identifier that does not match the unique identifier displayed on the display for that surgical robot.

62

AMENDED SHEET (ARTICLE 19)

The control system (306) of any preceding claim, wherein the safety monitor (316) is configured to determine that the surgical robot system (300) is in a fault state if the safety monitor (316) detects, from the communications to and/or from the main controller (312), that control signals for controlling the movement of a surgical robot of the at least one surgical robot cause an arm of that surgical robot to move between a first position and a second position, wherein moving between the first and second position would cause the arm of that surgical robot to exceed a maximum speed.

The control system (306) of any preceding claim, wherein the safety monitor (316) is configured to determine, based on the analysis, whether the surgical robot system is in a fault state of a plurality of different types of fault states.

A method (900) of determining a surgical robot system is in a fault state, the surgical robot system comprising at least one surgical robot, each of the at least one surgical robot comprising a base, and an arm extending from the base to an attachment for an instrument, the arm comprising a plurality of joints whereby the configuration of the arm can be altered, the method (900) comprising:

receiving, at a safety monitor, (i) at least a portion of communications from one or more devices of an operator console to a main controller of the surgical robot system identifying inputs from an operator of the at least one surgical robot, and (ii) communications sent from the main controller to the at least one surgical robot identifying control signals for controlling the movement of the at least one surgical robot arm, the control signals being based on the inputs from the operator (902);

analysing, at the safety monitor, (i) the at least a portion of the communications from the one or more devices of the operator console to the main controller, and (ii) the at least a portion of the communications from the main controller to the at least one surgical robot, to independently verify that each of one or more of the main controller, the one or more devices of the operator console and the at least one surgical robot is operating as expected (904);

determining, at the safety monitor, if the surgical robot system is in a fault state based on the analysis (906); and

AMENDED SHEET (ARTICLE 19)

in response to determining that the surgical robot system is in a fault state, causing at least one of the one or more devices of the operator console and at least one surgical robot to transition to a safe state (906, 908).