Interface control of treadmills. Risks with non-compliance of safety features

Interface control of treadmills. Risks with non-compliance of safety features

DOWNLOAD the full PDF

Dear customers, distributors, field service engineers and manufacturers,
A potential risk for patients and/or subjects on a remote controlled treadmill may arise, if the remote control from host equipment (PC, ECG, stress test, CPET, metabolic cart, MoCap, etc.) via interface
a) takes place through interface protocol without high safety standard, or
b) if safety features (failsafe, status communication, checksum and acknowledgement, etc.) of the interface protocol have not been implemented well.

Possible scenario:

1. A treadmill is remote controlled via ECG or metabolic cart during a cardiopulmonary stress test / ergometry.
2. The software of the ECG or metabolic cart has an incorporate load profile, for example Bruce, Naugthon or ramp protocol, where the treadmill belt speed and incline are automatically increased step by step based on pre-set time intervals.
3. The patient or the operator press STOP button on the treadmill or the emergency push-button on the treadmill because for example an ECG electrode became lose or the mask for VO2max measurement does not fit well.
4. The treadmill stops. Since the patient and operator feel safe, the patients turns 90° on the treadmill belt and then facing the operator / doctor in order to fix the electrodes or the mask.
5. Suddenly the treadmill belt automatically starts again without warning, when the patient is still standing 90° on the treadmill belt and facing the operator / doctor.
6. In such unexpected / unwanted start of the treadmill (when the subject and operator are not prepared) there is an increased risk of falling on a treadmill, which may result in serious injury.

This possible scenario can occur, if the manufacturer of the controlling host equipment and software (ECG, stress test, CPET, metabolic cart, MoCap, etc.) did not implement several safety features and functions which are available on safe treadmills.
Q: Why does the treadmill start suddenly?
A: Because in that scenario the software of the controlling ECG or metabolic cart did not communicate the STOP status of the treadmill. So “in the background” the automated load protocol was still active, and when the next stage of the protocol was due, the software of the controlling ECG or metabolic cart started the treadmill automatically again to continue the stress test.

h/p/cosmos treadmills with interface protocols coscom v3 and/or coscom v4 have safety features and functions which can prevent from such risks and accidents. See www.coscom.org

Extract of h/p/cosmos quality assurance & regulatory affairs agreement | coscom v3 | coscom v4 regarding standards EN 62304, ISO 14971 and medical device regulation MDR:
…
For staying in compliance with safety related issues, the MDD and the MDR on the interface communications and linkage of medical devices both parties agree to:
a) inform each other in writing before each party makes amendments on interface and/or software which can have safety related impact on the treadmill control. The same clause applies for other safety related parts & components.
b) perform & exchange tests & test protocols on interface and/or software which can have safety related impact on the treadmill and/or ergometer control.
b1) With electronic data logger all commands between the systems (treadmill/ergometer and host equipment/software) via coscom v3 or coscom v4 protocol are saved and documentation will be exchanged and analyzed, verified, validated and archived by both parties.
b2) Checksum and Acknowledgement have to be implemented in the interface protocol accordingly.
b3) Error simulation on failsafe function (timeout simulation of broken interface cable or PC failure or software crash) and with “status communication” of stop button pressed on the treadmill have to be made.
b4) If “stop” button was pressed on the treadmill and/or ergometer, also the load protocol on the host PC-Software or system has to stop and must not continue to send speed or elevation commands automatically. See implementation notes v3 or v4 on http://www.coscom.org
c) have internal documented and implemented bug-fixing process for medical device software maintenance during entire software life-cycle.
d) observe and inform each other in case of any amendment in the risk management status and/or regulatory affairs status, adverse event reporting and/or notifiable incident status and/or clinical data and post market surveillance (PMS) status.
e) exchange and report any kind of information of clinical studies, data and assessments that are related to h/p/cosmos devices as part of a market surveillance process. Both parties are obliged to set up internal procedures in order to assure the bi-directional reporting system for such a complaint handling and vigilance reporting and the exchange of market surveillance data related to the coscom interface control functions, features and safety.
f) Vigilance system: exchange and report any malfunction or deterioration in the characteristics and/or performance of the h/p/cosmos device (including a report about the incident and serial number of the device) within 10 days (or earlier if applicable in some countries), as well as any inadequacy in the labelling or the instructions for use which might lead to or might have led to the death of a patient or user or to a serious deterioration in his state of health.
g) record the serial numbers and end users names & addresses of all h/p/cosmos machines sold to customers & save those for at least 15 years or over the life time of the respective product. This is for organizing mailings in the unlikely event of product recalls or field corrective actions or warning messages.
h) allow access for the responsible notified bodies and authorities to quality and safety and regulatory affairs related documents and to the premises also for audits and unannounced audits where applicable.
i) archive quality and safety related documents for at least 15 years or for the expected lifetime of the product plus 5 years.
j) inform each other in case of any changes of scope or invalidity on the quality assurance certification (e.g. EC or ISO 13485 certificates)
…
Download of the checklist, sample agreement and template for test and release protocol.

Not only experts, software programmers or field service engineers can check if the treadmill control via host equipment is safe.
Some checks and simulations (not all!) can also be made by customers and operators of such treadmills controlled via stress test software.
Simple test scenario:

• Do not put anybody on the treadmill for safety reasons!
• control the treadmill via host equipment with an incorporate load profile, for example Bruce, Naugthon or ramp protocol, where the treadmill belt speed and incline are automatically increased step by step based on pre-set time intervals.
• press STOP button on the treadmill or the emergency push-button on the treadmill.
• wait several minutes until the next stage of the protocol was due
• the software of the controlling ECG or metabolic cart MUST NOT start the treadmill automatically again

For any questions and/or support and/or PMS observations on that please send an eMail to safety@hpcosmos.com