Failsafe programming of implantable medical devices

• US 7,373,206 B2
• Filed: 10/29/2003
• Issued: 05/13/2008
• Est. Priority Date: 10/31/2002
• Status: Active Grant

• Current Assignee: Medtronic Incorporated (Medtronic Plc)
• Original Assignee: Medtronic Incorporated (Medtronic Plc)
• Inventors: North, Richard B., Sieracki, Jeffrey M.
• Primary Examiner(s): Evanisko; George R.
• Assistant Examiner(s): KAHELIN, MICHAEL WILLIAM
• Application Number:
  US10/696,725
• Publication Number:
  US 20040138724A1
• Time in Patent Office: 1,658 Days
• Field of Search: 607/31, 607/30, 607/32, 607/59, 607/60
• US Class Current: 607/60
• CPC Class Codes: A61N 1/37252 Details of algorithms or data aspects of communication system, e.g. handshaking, transmitting specific data or segmenting data
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals
• CPC Class Codes: A61N 1/37264 Changing the program; Upgrading firmware
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G16H 40/40 for the management of medical equipment or devices, e.g. scheduling maintenance or upgrades

Abstract

A watchdog unit receives stay-alive signals from a programming device during programming of an implantable medical device. The watchdog unit maintains a watchdog timer, and resets the timer upon receipt of each stay-alive signal. If the watchdog timer expires, the watchdog unit changes a mode of operation of the implantable device, e.g., places the implantable medical device into a known, safe state. For example, the watchdog unit may cause the implantable medical device to suspend delivery of therapy, perform a power-on reset, and/or recall a known, safe, therapy delivery program.

Claims

1. A method comprising:

receiving programming signals and stay-alive signals from a programming device at a watchdog unit coupled to the programming device during a programming session between the programming device and an implantable medical device;

resetting a watchdog timer maintained by the watchdog unit in response to receipt of each of the programming signals and the stay-alive signals; and

sending a signal from the watchdog unit to the implantable medical device via wireless telemetry to change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

2. The method of claim 1, wherein the watchdog unit is coupled to the programming device by a cable, and receiving programming signals and slay-alive signals comprises detecting transitions on a data line of the cable.

3. The method of claim 1, wherein sending a signal to the implantable medical device comprises directing the implantable medical device to suspend delivery of therapy.

4. The method of claim 1, wherein sending a signal to the implantable medical device comprises directing the implantable medical device to perform a power-on reset.

5. The method of claim 1, wherein sending a signal to the implantable medical device comprises providing a program to the implantable medical device, the program controlling delivery of therapy by the implantable medical device.

6. The method of claim 1, wherein sending a signal to the implantable medical device includes causing the implantable medical device to revert to a program previously stored within a memory of the implantable medical device.

7. The method of claim 1, further comprising:

receiving a signal from the programming device at the watchdog unit that indicates initiation of a programming operation; and

initializing the watchdog timer in response to the signal.

8. The method of claim 1, further comprising:

receiving power at the watchdog unit from the programming device;

detecting a failure of power delivery by the programming device;

activating an auxiliary power source of the watchdog unit in response to the detection; and

sending a signal from the watchdog unit to the implantable medical device via wireless telemetry to change the mode of operation of the implantable medical device in response to the detection.

9. The method of claim 1, further comprising:

receiving an emergency-off signal from a user at the watchdog unit; and

sending a signal from the watchdog unit to the implantable medical device via wireless telemetry to change the mode of operation of the implantable medical device in response to receipt of the signal.

10. A watchdog unit comprising:

a telemetry circuit; and

a processor to receive programming signals and stay-alive signals from a programming device coupled to the watchdog unit during a programming session between the programming device and an implantable medical device, reset a watchdog timer in response to receipt of each of the programming signals and the stay-alive signals, and send a signal to the implantable medical device via the telemetry circuit to change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

11. The watchdog unit of claim 10, wherein the processor is coupled to a data line of a cable, and the processor receives programming signals and stay-alive signals by detecting transitions on the data line.

12. The watchdog unit of claim 10, wherein the signal causes the implantable medical device to suspend delivery of therapy.

13. The watchdog unit of claim 10, wherein the signal causes the implantable medical device to perform a power-on reset.

14. The watchdog unit of claim 10, further comprising a memory to store a program that controls delivery of therapy by the implantable medical device, wherein the processor changes the mode of operation of the implantable medical device by providing the program to the implantable medical device via the telemetry circuit.

15. The watchdog unit of claim 10, wherein the signal causes the implantable medical device to revert to a program previously stored within a memory of the implantable medical device.

16. The watchdog unit of claim 10, wherein the processor receives a signal from the programming device that indicates initiation of a programming operation, and initializes the watchdog timer in response to the signal.

17. The watchdog unit of claim 10,

wherein the watchdog unit receives power from the programming device, the watchdog unit further comprising an auxiliary power source, and

wherein the processor detects a failure of power delivery by the programming device, activates the auxiliary power source in response to the detection, and sends a signal to the implantable medical device via the telemetry circuit to change the mode of operation of the implantable medical device in response to the detection.

18. The watchdog unit of claim 10, further comprising a user interface, wherein the processor receives an emergency-off signal in response to interaction of a user with the user interface, and sends a signal to the implantable medical device via the telemetry circuit to change the mode of operation of the implantable medical device in response to receipt of the signal.

19. The watchdog unit of claim 10, wherein the programming device is coupled to a programming head by a cable, and the watchdog unit is located within the programming head.

20. The watchdog unit of claim 10, wherein the programming device is coupled to a programming head by a cable, and watchdog unit couples the cable to the programming head.

21. A computer-readable medium comprising instructions that cause a programmable processor to:

receive programming signals and stay-alive signals at a watchdog unit coupled to a programming device from the programming device during a programming session between the programming device and an implantable medical device;

reset a watchdog timer maintained by the watchdog unit in response to receipt of each of the programming signals and the stay-alive signals; and

send a signal from the watchdog unit to the implantable medical device via wireless telemetry to change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

22. The computer-readable medium of claim 21, wherein the instructions that cause a programmable processor to send a signal to the implantable medical device comprise instructions that cause a programmable processor to direct the implantable medical device to suspend delivery of therapy.

23. The computer-readable medium of claim 21, wherein the instructions that cause a programmable processor to send a signal to the implantable medical device comprise instructions that cause a programmable processor to direct the implantable medical device to perform a power-on reset.

24. The computer-readable medium of claim 21, wherein the instructions that cause a programmable processor to send a signal to the implantable medical device comprise instructions that cause a programmable processor to provide a program to the implantable medical device, the program controlling delivery of therapy by the implantable medical device.

25. The computer-readable medium of claim 21, wherein the instructions that cause a programmable processor to send a signal to the implantable medical device comprise instructions that cause a programmable processor to direct the implantable medical device to revert to a program previously stored within a memory of the implantable medical device.

26. The computer-readable medium of claim 21, further comprising instructions that cause a programmable processor to;

receive a signal at the watchdog unit from the programming device that indicates initiation of a programming operation; and

initialize the watchdog timer in response to the signal.

27. The computer-readable medium of claim 21, further comprising instructions that cause a programmable processor to:

detect a failure of power delivery by the programming device;

activate an auxiliary power source of the watchdog unit in response to the detection; and

send a signal from the watchdog unit to the implantable medical device via wireless telemetry to change the mode of operation of the implantable medical device in response to the detection.

28. The computer-readable medium of claim 21, further comprising instructions that cause a programmable processor to:

receive an emergency-off signal from a user at the watchdog unit; and

send a signal from the watchdog unit to the implantable medical device via wireless telemetry to change the mode of operation of the implantable medical device in response to the signal.

29. A system comprising:

a programming device;

an implantable medical device; and

a watchdog unit coupled to the programming device to receive programming signals and stay-alive signals from the programming device during a programming session between the programming device and the implantable medical device, reset a watchdog timer maintained by the watchdog unit in response to receipt of each of the programming signals and the stay-alive signals, and send a signal from the watchdog unit to the implantable medical device via wireless telemetry to change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

30. The system of claim 29, wherein the implantable medical device comprises a memory to store a program that controls delivery of therapy by the implantable medical device, wherein the watchdog unit causes the implantable medical device to delivery therapy according to the program in response to expiration of the watchdog timer.

31. The system of claim 29, wherein the watchdog unit receives a signal from the programming device that indicates initiation of a programming operation, and initializes the watchdog timer in response to the signal.

32. The system of claim 29, wherein the implantable medical device comprises an implantable neurostimulator.