Failsafe programming of implantable medical devices

• US 20040138724A1
• Filed: 10/29/2003
• Published: 07/15/2004
• Est. Priority Date: 10/31/2002
• Status: Active Grant

• Current Assignee: Medtronic Incorporated (Medtronic Plc)
• Original Assignee: Medtronic Incorporated (Medtronic Plc)
• Inventors: North, Richard B., Sieracki, Jeffrey M.
• Granted Patent: US 7,373,206 B2
• Time in Patent Office: Days
• US Class Current: 607/60
• CPC Class Codes: A61N 1/37252 Details of algorithms or data aspects of communication system, e.g. handshaking, transmitting specific data or segmenting data
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals
• CPC Class Codes: A61N 1/37264 Changing the program; Upgrading firmware
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G16H 40/40 for the management of medical equipment or devices, e.g. scheduling maintenance or upgrades

Abstract

A watchdog unit receives stay-alive signals from a programming device during programming of an implantable medical device. The watchdog unit maintains a watchdog timer, and resets the timer upon receipt of each stay-alive signal. If the watchdog timer expires, the watchdog unit changes a mode of operation of the implantable device, e.g., places the implantable medical device into a known, safe state. For example, the watchdog unit may cause the implantable medical device to suspend delivery of therapy, perform a power-on reset, and/or recall a known, safe, therapy delivery program.

Claims

1. A method comprising:

receiving stay-alive signals from a programming device during the course of a wireless telemetry session between the programming device and an implantable medical device;

resetting a watchdog timer in response to receipt of each of the stay-alive signals; and

changing a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

2. The method of claim 1, wherein receiving stay-alive signals comprises detecting transitions on a data line.

3. The method of claim 1, wherein receiving stay-alive signals comprises receiving stay-alive signals via wireless telemetry.

4. The method of claim 1, wherein receiving stay-alive signals comprises receiving programming signals and stay-alive signals, and resetting a watchdog timer comprises resetting the watchdog timer in response to each of the programming signals and stay-alive signals.

5. The method of claim 1, wherein changing a mode of operation of the implantable medical device comprises directing the implantable medical device to suspend delivery of therapy.

6. The method of claim 1, wherein changing a mode of operation of the implantable medical device comprises directing the implantable medical device to perform a power-on reset.

7. The method of claim 1, wherein changing a mode of operation of the implantable medical device comprises providing a program to the implantable medical device, the program controlling delivery of therapy by the implantable medical device.

8. The method of claim 1, wherein changing a mode of operation of the implantable medical device includes causing the implantable medical device to revert to a previously stored program.

9. The method of claim 1, wherein changing a mode of operation of the implantable medical device comprises sending a signal to the implantable medical device via wireless telemetry.

10. The method of claim 1, further comprising:

receiving a signal from the programming device that indicates initiation of a programming operation; and

initializing the watchdog timer in response to the signal.

11. The method of claim 1, further comprising:

receiving power from the programming device;

detecting a failure of power delivery by the programming device;

activating an auxiliary power source in response to the detection; and

changing the mode of operation of the implantable medical device in response to the detection.

12. The method of claim 1, further comprising:

receiving an emergency-off signal from a user; and

changing the mode of operation of the implantable medical device in response receipt of the signal.

13. A device comprising:

a telemetry circuit; and

a processor to receive stay-alive signals from a programming device during the course of a wireless telemetry session between the programming device and an implantable medical device, reset a watchdog timer in response to receipt of each of the stay-alive signals, and send a signal to the implantable medical device via the telemetry circuit to change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

14. The device of claim 13, wherein the processor is coupled to a data line of a cable, and the processor receives stay-alive signals by detecting transitions on the data line.

15. The device of claim 13, wherein the signal causes the implantable medical device to suspend delivery of therapy.

16. The device of claim 13, wherein the signal causes the implantable medical device to perform a power-on reset.

17. The device of claim 13, further comprising a memory to store a program that controls delivery of therapy by the implantable medical device, wherein the processor changes the mode of operation of the implantable medical device by providing the program to the implantable medical device via the telemetry circuit.

18. The device of claim 13, wherein the signal causes the implantable medical device to revert to a previously stored program.

19. The device of claim 13, wherein the processor receives a signal from the programming device that indicates initiation of a programming operation, and initializes the watchdog timer in response to the signal.

20. The device of claim 13, wherein the device receives power from the programming device, the device further comprising an auxiliary power source, and

wherein the processor detects a failure of power delivery by the programming device, activates the auxiliary power source in response to the detection, and sends a signal to the implantable medical device via the telemetry circuit to change the mode of operation of the implantable medical device in response to the detection.

21. The device of claim 13, further comprising a user interface, wherein the processor receives an emergency-off signal in response to interaction of a user with the user interface, and sends a signal to the implantable medical device via the telemetry circuit to change the mode of operation of the implantable medical device in response to receipt of the signal.

22. The device of claim 13, wherein the programming device is coupled to a programming head by a cable, and the device is located within the programming head.

23. The device of claim 13, wherein the programming device is coupled to a programming head by a cable, and device couples the cable to the programming head.

24. An implantable medical device comprising:

a telemetry circuit; and

a watchdog unit to receive stay-alive signals from a programming device via the telemetry circuit during the course of a wireless telemetry session between the programming device and the implantable medical device, reset a watchdog timer in response to receipt of each of the stay-alive signals, and change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

25. The implantable medical device of claim 24, wherein the watchdog unit receives stay-alive signals and programming signals via the telemetry circuit, and resets the watchdog timer in response to each of the stay-alive signals and the programming signals.

26. The implantable medical device of claim 24, wherein the watchdog unit suspends delivery of therapy by the implantable medical device in response to expiration of the watchdog timer.

27. The implantable medical device of claim 24, wherein the watchdog unit cause the implantable medical device to perform a power-on reset.

28. The implantable medical device of claim 24, further comprising a memory to store a program that controls delivery of therapy by the implantable medical device, wherein the watchdog unit cause the implantable medical device to delivery therapy according to the program in response to expiration of the watchdog timer.

29. The implantable medical device of claim 24, wherein the watchdog unit receives a signal from the programming device via the telemetry circuit that indicates initiation of a programming operation, and initializes the watchdog timer in response to the signal.

30. The implantable medical device of claim 24, wherein the watchdog unit comprises a processor.

31. The implantable medical device of claim 30, wherein the processor comprises a processor that controls operation of the implantable medical device.

32. The implantable medical device of claim 24, wherein the implantable medical device comprises an implantable neurostimulator.

33. A computer-readable medium comprising instructions that cause a programmable processor to:

receive stay-alive signals from a programming device during the course of a wireless telemetry session between the programming device and an implantable medical device;

reset a watchdog timer in response to receipt of each of the stay-alive signals; and

change a mode of operation of the implantable medical device in response to expiration of the watchdog timer.

34. The computer-readable medium of claim 33, wherein the instructions that cause a programmable processor to receive stay-alive signals comprise instructions that cause a programmable processor to:

receive programming signals and stay-alive signals from the programming device; and

reset the watchdog timer in response to each of the programming signals and stay-alive signals.

35. The computer-readable medium of claim 33, wherein the instructions that cause a programmable processor to change a mode of operation of the implantable medical device comprise instructions that cause a programmable processor to direct the implantable medical device to suspend delivery of therapy.

36. The computer-readable medium of claim 33, wherein the instructions that cause a programmable processor to change a mode of operation of the implantable medical device comprise instructions that cause a programmable processor to direct the implantable medical device to perform a power-on reset.

37. The computer-readable medium of claim 33, wherein the instructions that cause a programmable processor to change a mode of operation of the implantable medical device comprise instructions that cause a programmable processor to provide a program to the implantable medical device, the program controlling delivery of therapy by the implantable medical device.

38. The computer-readable medium of claim 33, wherein the instructions that cause a programmable processor to change a mode of operation of the implantable medical device comprise instructions that cause a programmable processor to direct the implantable medical device to revert to a previously stored program.

39. The computer-readable medium of claim 33, further comprising instructions that cause a programmable processor to:

receive a signal from the programming device that indicates initiation of a programming operation; and

initialize the watchdog timer in response to the signal.

40. The computer-readable medium of claim 33, further comprising instructions that cause a programmable processor to:

detect a failure of power delivery by the programming device;

activate an auxiliary power source in response to the detection; and

change the mode of operation of the implantable medical device in response to the detection.

41. The computer-readable medium of claim 33, further comprising instructions that cause a programmable processor to:

receive an emergency-off signal from a user; and

change the mode of operation of the implantable medical device in response to the signal.

42. A method comprising:

sending programming signals that affect operation of an implantable medical device to the implantable medical device via wireless telemetry during a programming operation; and

sending stay-alive signals to a watchdog unit during the programming operation to allow the watchdog unit to detect failure of a wireless telemetry session between a programming device and the implantable medical device during the programming operation.

43. The method of claim 42, further comprising sending signals to the watchdog unit to indicate the beginning and ending of the programming operation.

44. The method of claim 42, wherein sending stay-alive signals comprises generating transitions on a data line.

45. The method of claim 42, wherein sending stay-alive signals comprises sending stay-alive signals via wireless telemetry.

46. The method of claim 42, wherein sending stay-alive signals comprises:

resetting a timer upon delivery of a programming signal; and

sending a stay-alive signal upon expiration of the timer.

47. A programming device comprising:

a telemetry circuit; and

a processor to send programming signals that affect operation of an implantable medical device to the implantable medical device via the telemetry circuit during a programming operation, and send stay-alive signals to a watchdog unit during the programming operation to allow the watchdog unit to detect failure of a wireless telemetry session between the programming device and the implantable medical device during the programming operation.

48. The programming device of claim 47, wherein the programming device is coupled to a telemetry head by a cable, wherein the processor sends stay-alive signals by generating transitions on a data line of the cable.

49. The programming device of claim 47, wherein the processor sends stay-alive signals via the telemetry circuit.

50. The programming device of claim 47, wherein the processor resets a timer upon delivery of a programming signal, and sends a stay-alive signal upon expiration of the timer.

51. A computer-readable medium comprising instructions that cause a programmable processor to:

send programming signals that affect operation of an implantable medical device to the implantable medical device via wireless telemetry during a programming operation; and

send stay-alive signals to a watchdog unit during the programming operation to allow the watchdog unit to detect failure of a wireless telemetry session between a programming device and the implantable medical device during the programming operation.

52. The computer-readable medium of claim 51, further comprising instructions that cause a programmable processor to send signals to the watchdog unit to indicate the beginning and ending of the programming operation.

53. The computer-readable medium of claim 51, wherein the instructions that cause a programmable processor to send stay-alive signals comprise instructions that cause a programmable processor to:

reset a timer upon delivery of a programming signal; and

send a stay-alive signal upon expiration of the timer.