CONTROL SYSTEM FOR SURGICAL ROBOT SYSTEM WITH SAFETY MONITOR

1 . A control system for controlling a surgical robot system, the surgical robot system comprising at least one surgical robot, each of the at least one surgical robot comprising a base, and an arm extending from the base to an attachment for an instrument, the arm comprising a plurality of joints whereby the configuration of the arm can be altered, the control system comprising:

a main controller configured to:

receive communications from one or more devices of an operator console identifying inputs from an operator of the at least one surgical robot;

generate control signals for controlling the movement of the at least one surgical robot arm based on the inputs; and

send communications to the at least one surgical robot identifying the control signals; and

a safety monitor configured to:

analyse Q at least a portion of the communications from the one or more devices of the operator console to the main controller, and cii) at least a portion of the communications from the main controller to the at least one surgical robot, to independently verify that each of one or more of the main controller, the one or more devices of the operator console and the at least one surgical robot are operating as expected;

determine, based on the analysis, whether the surgical robot system is in a fault state; and

in response to determining that the surgical robot system is in a fault state, cause at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state.

2 . The control system of claim 1 , wherein the safety monitor is configured to cause the at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state by causing communications between the at least one of the one or more devices of the operator console and the at least one surgical robot and the main controller to be blocked.

3 . The control system of claim 1 , wherein the safety monitor is configured to cause the at least one of the one or more devices of the operator console and the at least one surgical robot to transition to a safe state by causing a safety device to filter communications between the at least one of the one or more devices of the operator console and the at least one surgical robot, and the main controller.

4 . The control system of claim 3 , wherein the safety monitor is configured to cause the safety device to filter communications between the at least one of the one or more devices of the operator console and the at least one surgical robot, and the main controller by writing information to at least one register of a set of registers that indicates to the safety device that the communications between the at least one of the one or more devices of the operator console and the at least one surgical robot, and the main controller is to be filtered.

5 . The control system of claim 3 , further comprising the safety device.

6 . The control system of claim 5 , wherein the safety device is configured to receive communications to and from the main controller and provide a copy of at least a portion of the communications to and from the main controller to the safety monitor.

7 . The control system of claim 1 , wherein the at least one of the one or more devices of the operator console and the at least one surgical robot are transitioned to a safe state are based on a type of fault state determined.

8 . The control system of claim 1 , wherein the safety monitor is configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that the control signals for controlling the movement of at least one of the at least one surgical robot arm cause that surgical robot arm to move to a position that is inconsistent with a current state of that surgical robot arm and/or the inputs from the operator.

9 . The control system of claim 1 , wherein the safety monitor is configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communication to and/or from the main controller, that a frequency of communications from at least one of the one or more devices of an operator console and the at least one surgical robot to the main controller is below a predetermined threshold or that a frequency of communication from the main controller to at least one of the one or more devices of an operator console and the at least one surgical robot is below a predetermined threshold.

10 . The control system of claim 1 , wherein the safety monitor is configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that at least one of the one or more devices of the operator console and the at least one surgical robot is running software that is not compatible with the main controller.

11 . The control system of claim 1 , wherein the at least one surgical robot comprises a plurality of surgical robots and each of the plurality of surgical robots is allocated a unique identifier, and the safety monitor is configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that at least two of the surgical robots send communications indicating that they are allocated the same unique identifier.

12 . The control system of claim 1 , wherein the at least one surgical robot comprises a plurality of surgical robots, and each of the plurality of surgical robots is allocated a unique identifier and the allocated unique identifier is displayed on a display of the operator console, and the safety monitor is configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that surgical robot of the plurality of surgical robots is reporting a unique identifier that does not match the unique identifier displayed on the display for that surgical robot.

13 . The control system of claim 1 , wherein the safety monitor is configured to determine that the surgical robot system is in a fault state if the safety monitor detects, from the communications to and/or from the main controller, that control signals for controlling the movement of a surgical robot of the at least one surgical robot cause an arm of that surgical robot to move between a first position and a second position, wherein moving between the first and second position would cause the arm of that surgical robot to exceed a maximum speed.

14 . The control system of claim 1 , wherein the safety monitor is configured to determine, based on the analysis, whether the surgical robot system is in a fault state of a plurality of different types of fault states.

15 . A method of determining a surgical robot system is in a fault state, the surgical robot system comprising at least one surgical robot, each of the at least one surgical robot comprising a base, and an arm extending from the base to an attachment for an instrument, the arm comprising a plurality of joints whereby the configuration of the arm can be altered, the method comprising:

receiving, at a safety monitor, Q at least a portion of communications to from one or more devices of an operator console to a main controller of the surgical robot system identifying inputs from an operator of the at least one surgical robot, and (ii) communications sent from the main controller to the at least one surgical robot identifying the control signals for controlling the movement of the at least one surgical robot arm, control signals being based on the inputs from the operator;

analysing, at the safety monitor, the at least a portion of the communications from the one or more devices of the operator console to and the at least a portion of the communications from the main controller to the at least one surgical robot, to independently verify that each of one or more of the main controller, the one or more devices of the operator console and the at least one surgical robot is operating as expected;

determining, at the safety monitor, if the surgical robot system is in a fault state based on the analysis; and

in response to determining that the surgical robot system is in a fault state, causing at least one of the one or more devices of the operator console and at least one surgical robot to transition to a safe state.