Safety critical electronic device lock

Patent metadata

Field	Value
Publication number	US-12290677-B2
Application number	US-201917261234-A
Country	US
Kind code	B2
Filing date	Sep 6, 2019
Priority date	Sep 12, 2018
Publication date	May 6, 2025
Grant date	May 6, 2025

Abstract

Presented herein are techniques for electronically locking an electronic device in response to detection of a safety critical fault. As used herein, a “safety critical fault” is a fault having a potential to cause harm to an individual using the device. In particular, an electronic device in accordance with certain embodiments presented herein is configured to determine when the electronic device has experienced a safety critical fault. In response, the electronic device automatically restarts itself and, following restart, is automatically forced into a locked mode. The locked mode prevents execution of a run-time program stored in the electronic device.

First claim

What is claimed is:

1. A method, comprising:
determining, with an implantable component of a medical device, that the implantable component has experienced a safety critical fault, wherein the implantable component includes read-only memory (ROM) and non-volatile memory (NVM);
in response to determining that the medical device has experienced the safety critical fault, purposely corrupting, by the implantable component, a memory block of the non-volatile memory (NVM); and
automatically forcing the implantable component into a locked mode,
wherein the locked mode prevents execution of a run-time program stored in the implantable component.

2. The method of claim 1 , wherein the locked mode only allows limited read and write functions to memory of the implantable component from a secondary device.

3. The method of claim 1 , wherein automatically forcing the implantable component into the locked mode comprises:
automatically restarting the implantable component such that the implantable component executes code stored in read-only memory (ROM) of the implantable component, wherein execution of the code stored in the ROM checks non-volatile memory (NVM) of the implantable component for corrupt memory blocks;
determining that a memory block in the NVM is corrupt; and
in response to determining that the memory block in the NVM is corrupt, indefinitely executing the code stored in the ROM.

4. The method of claim 3 , wherein determining that the memory block in the NVM is corrupt comprises:
performing a Cyclic Redundancy Check (CRC) check on the NVM.

5. The method of claim 1 , wherein prior to determining that the implantable component has experienced the safety critical fault, the method comprises:
determining that the implantable component has experienced an uncategorized fault;
restarting the implantable component such that the implantable component executes code stored in read-only memory (ROM) of the implantable component, wherein execution of the code stored in the ROM checks non-volatile memory (NVM) of the implantable component for corrupt memory blocks;
executing the code stored in the ROM without detecting any corrupt memory blocks;
loading, into program memory, the run-time program for execution; and
upon execution of the run-time program, determining that the uncategorized fault is a safety critical fault.

6. The method of claim 5 , wherein in response to determining that the uncategorized fault is a safety critical fault, the method comprises:
storing an indication of the safety critical fault in the NVM.

7. The method of claim 1 , wherein detecting a safety critical fault comprises:
detecting a short circuit condition in the implantable component.

8. The method of claim 1 , wherein the implantable component includes an implantable battery, and wherein detecting a safety critical fault comprises:
detecting that a voltage of the implantable battery has reached a maximum voltage threshold or detecting that the implantable battery has been overcharged.

9. An implantable medical device, comprising:
non-volatile memory (NVM) configured to store a run-time program; and
at least one processor configured to:
execute the run-time program, wherein the execution of the run-time program detects a safety critical fault in operation of the implantable medical device;
in response to the detection of the safety critical fault, purposely corrupt, by the implantable medical device, a memory block of the NVM;
restart the implantable medical device and initiate a locked mode, wherein the locked mode includes validation of the NVM of the implantable medical device;
determine that the NVM is corrupt; and
in response to determination that the NVM is corrupt, prevent re-execution of the run-time program.

10. The implantable medical device of claim 9 , wherein the locked mode only allows limited read and write functions to the NVM from a secondary device.

11. The implantable medical device of claim 9 , wherein to validate the NVM of the device, the processor is configured to perform a Cyclic Redundancy Check (CRC) check on the NVM.

12. The implantable medical device of claim 9 , wherein prior to the determining that the medical device has experienced the safety critical fault, the processor is configured to:
determine that the medical device has experienced an uncategorized fault;
in response to determining that the medical device has experienced the uncategorized fault, restart the medical device and execute code stored in read-only memory (ROM) of the medical device;
validate the NVM;
upon successfully validating the NVM, loading into program memory the run-time program for execution; and
upon execution of the run-time program, determining that the uncategorized fault is a safety critical fault.

13. The implantable medical device of claim 12 , wherein in response to determining that the uncategorized fault is a safety critical fault, the processor is configured to:
store an indication of the safety critical fault in the NVM.

14. The implantable medical device of claim 9 , wherein to prevent re-execution of the run-time program, the processor continually executes code stored in read-only memory (ROM) of the implantable medical device.

15. The implantable medical device of claim 9 , wherein the NVM and the at least one processor are configured to be implanted in a recipient of the implantable medical device.

16. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor of an implantable medical device, cause the processor to:
determine, using data from an integrated diagnostic mechanism of the implantable medical device, that the implantable medical device has experienced a safety critical fault, wherein the implantable medical device comprises non-volatile memory (NVM) and read-only memory (ROM);
in response to determining that the implantable medical device has experienced the safety critical fault, purposely corrupt, by the implantable medical device, a memory block of the non-volatile memory (NVM);
automatically restart the implantable medical device;
determine whether non-volatile memory (NVM) of the implantable medical device is corrupt; and
in response to determining that the NVM is corrupt, indefinitely execute code stored in read-only memory (ROM) of the implantable medical device.

17. The one or more non-transitory computer readable storage media of claim 16 , wherein the instructions that cause the processor to indefinitely execute code stored in the ROM of the implantable medical device comprise instructions that cause the processor to:
prevent execution of a run-time program stored in NVM of the implantable medical device.

18. The one or more non-transitory computer readable storage media of claim 16 , wherein the instructions that cause the processor to indefinitely execute code stored in the ROM of the implantable medical device comprise instructions that cause the processor to:
only allow limited read and write functions to the NVM of the implantable medical device from a secondary device.

19. The one or more non-transitory computer readable storage media of claim 16 , wherein the instructions that cause the processor to determine whether the NVM of the implantable medical device is corrupt comprise instructions that cause the processor to:
perform a Cyclic Redundancy Check (CRC) check on the NVM.

20. The one or more non-transitory computer readable storage media of claim 16 , further comprising instru

Assignees

• Cochlear Ltd

Inventors

• Eder Helmut Christian
• Trieu Michael

Classifications

• G06F2201/81

  Threshold · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/0736

  in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function (testing or monitoring of automated control systems G05B23/02) · CPC title

• A61N1/36142

  for improving safety · CPC title

• A61N1/08

  Arrangements or circuits for monitoring, protecting, controlling or indicating {(for external stimulators A61N1/3603; for implantable neurostimulators A61N1/36128; for heart stimulators A61N1/37; for defibrillators A61N1/3925)} · CPC title