WO2013139667A1

WO2013139667A1 - Method for detecting a malfunction of an interface device, circuit arrangement with an interface device, and medical device with such a circuit arrangement

Info

Publication number: WO2013139667A1
Application number: PCT/EP2013/055188
Authority: WO
Inventors: Dominic BUCHSTALLER; Amjad MOHSEN; Johannes Reinschke
Original assignee: Siemens Aktiengesellschaft
Priority date: 2012-03-20
Filing date: 2013-03-14
Publication date: 2013-09-26
Also published as: DE102012204361A1

Abstract

The invention relates to a circuit arrangement (50) with an electronic circuit (26, 32, 52) and at least one interface device (26, 32, 52) which is designed to couple the electronic circuit (26, 32, 52) to an external signal line (34, 36, 46). For this purpose, the interface device (24, 32, 52) has a transmitting unit (56, 58, 70, 78) which is designed to receive an input signal (24, 28, 34) and to process the input signal. The interface device (26, 32, 52) has at least two additional transmitting units (56, 58, 70, 78) of the same type, and the signal inputs of each transmitting unit (56, 70, 78) are designed to receive the same input signal (34, 24). Each transmitting unit (56, 58, 70, 78) is coupled to a comparing device (62, 74, 82) which is designed to compare the signals (60, 72, 80) processed by the transmitting units (56, 70, 78) and to signal a deviation between the compared signals (60, 72, 80) by means of a deviation signal.

Description

description

Method for detecting an incorrect functioning of an interface device, circuit arrangement with an interface device and medical device with such a circuit arrangement

The invention relates to a circuit arrangement with an electronic, in particular digital, circuit and at least one interface device, which couples the electronic circuit with an external signal line, so that a signal can be transmitted in at least one transmission direction between the electronic circuit and the signal line. The invention also includes a method for detecting a faulty functioning of a transmission unit of such an interface device. Finally, the invention comprises a medical device which has a source of radioactive radiation or X-radiation and in which a control unit is provided which is arranged in an area penetrated by the radiation of the source.

Electronic circuits, such as may be used to evaluate measurement signals or generate control signals, sometimes need to operate in an environment where there is a high risk of compromising the performance of the circuit. So it may be that an electronic circuit at high temperatures, in a strong electric or magnetic field or in one of X-rays or radioactive

Radiation penetrated area must be used. Examples of devices with such circuits can be found in radiation therapy, where such circuits are required for digitizing measured values or for actuating servomotors. In this case, the circuits can then be exposed in particular to gamma radiation and possibly also to beta and neutron radiation. In an irradiation device for cancer therapy, this is the control electronics for motors of collimator blades of a collimator and the transmitter for associated position sensors of the motors of the case. In order to avoid an unexpected malfunction of such circuits, they must first be protected against the harmful environmental influences. On the other hand, such protection may not always be perfect, so that it is also desirable, in the event of a malfunction of a component of an electronic circuit, at least to recognize that its functioning is disturbed. At best, then measures are provided to compensate even in case of malfunction of a component malfunction and to be able to continue to operate the electronic circuit. A particular difficulty in detecting a malfunction arises in connection with the interfaces of an electronic circuit, via which it is coupled with other electrical or electronic devices. If, for example, a signal of a sensor is received via such an interface, such as an analog-to-digital converter, then it is not possible for the digital circuit to detect from the received measurement signal whether its course is determined by the measured physical variable itself or resulting from a malfunction of the interface. For this one would have to know the measuring signal of the sensor itself.

In connection with the increase of the robustness of an FPGA (field programmable gate array) against the interfering influence of radioactive radiation on its memory cells, US Pat. No. 4,768,317 B1 discloses four memory cells each for storing an on state or an off state to program the same state. In each case two of the memory cells are connected in series and the two series connection finally connected in parallel. This compensates for two types of errors, such as those caused by radioactive radiation in individual ones of the memory cells. In connection with the detection of an erroneous operation of an error correcting device (ECC) within a digital circuit, US 2008/0297191 A1 and US Pat. No. 7443191 B2 disclose this memory cell during three consecutive read cycles when reading out a specific memory cell by means of the error correction device read out three times. The result of each readout process is stored in a separate register. These three registers in total are coupled to a comparison logic which determines whether the majority of the registers have the same value, ie whether the same value is stored in at least two registers. If so, this value is then displayed as the actual content of the memory by the comparison logic.

The object of the present invention is to at least detect a faulty mode of operation of a cut-digit device of an electronic circuit in the case of a circuit arrangement.

The object is achieved by a circuit arrangement according to claim 1, a medical device according to claim 11 and a method according to claim 14. Advantageous developments of the invention are given by the subclaims.

The circuit arrangement according to the invention is based on an interface device which, in a circuit arrangement, couples an electronic circuit to an external signal line and which for this purpose has a transmission unit which receives an input signal depending on the direction of transmission either from the signal line or the circuit and processes this input signal to it output at the output of the cut - digit device to the electronic circuit or to the external signal line. In connection with the invention, the interface device may be, for example, a bus or network interface. In this case, the described transmission is the MAC device (MAC medium access control) usually provided for such a network interface. In such a case, the transmission unit preferably also has an error correction device (ECC - ECC Error Correction Code). A further possibility of an interface device, as may be provided in connection with the circuit arrangement according to the invention, is a pulse width modulation, in which case the transmission unit comprises a pulse width modulator. Another example of an interface device is a measuring input, in which the transmission unit has an analog-to-digital converter.

In order to protect such an interface device against the influence of a disturbance variable from the environment, in particular against

X-ray radiation and radioactive radiation to design robust, is provided in the circuit arrangement according to the invention that the interface device in addition to the one transmission unit has at least two further transmission units of the same type. The signal inputs of all these transmission units are designed to receive the same input signal. In other words, the transmission units are operated in parallel for processing the same input signal. Thus, the received and processed input signal is present at least three times. The outputs of the transmission devices are coupled to a comparison device that is designed to compare the signals processed by the transmission units and to signal a deviation between the compared signals by a deviation signal. This mode of operation is summarized in the method also belonging to the invention. For example, the comparator may simply be logic gates or a program executed by the electronic circuit.

The circuit arrangement according to the invention and the method according to the invention have the advantage that within the Interface device can be detected regardless of the actual course of the input signal, whether the transmission units work correctly. By providing at least three transmission units of the same type, one recognizes that it is extremely unlikely that two of the transmission units will be disturbed in exactly the same way, and thus two identical but incorrect processing results may result. In particular, in the case where the transmission units provide the same processing function as needed, but have a different construction, it is extremely unlikely that two transmission units have identical malfunctions when operating in the same environment.

In order not only to recognize a malfunction, but also to be able to compensate for it, an advantageous development of the circuit arrangement provides that all transmission units are coupled to a selection circuit which is designed to signal the output of the interface device in signaling a deviation by the comparison device the way in which the output signal is a processed signal from one of those transmission units whose processed signal matches that of most others. In other words, an output signal is provided that matches the majority of the compared signals. In the case of three transmission units, this means that in the event of a malfunction of one of the transmission units, the output signal is output by one of the other two transmission units.

In contrast to a permanent disturbance, such as overheating, a particular failure is the sporadic disturbances such as may be caused by radioactive radiation, for example, by changing the content of a configuration memory of one of the transmission units due to an ionizing effect. After that- In this way, the transmission unit continues to function properly, but only with a changed configuration. Here it is worthwhile to transfer the transmission unit back to the desired state, since the actual malfunction is no longer present. For this purpose, an embodiment of the circuit arrangement according to the invention provides a restarting device, which is designed to generate a reset signal, if a difference is detected by the comparison device when comparing the signals processed by the transmission units. The reset signal is transmitted at least to that transmission unit whose processed signal deviated from the majority of the compared signals. This transfer unit is then restarted, which overwrites, for example, the changed memory content of the configuration memory. The generation of the reset signal can take place directly within the interface device, for example by the comparison device being coupled directly to the transmission units via a corresponding reset line. Another possibility is given in an embodiment in which the circuit arrangement additionally has a monitoring device (monitoring circuit), which can be coupled to both the comparison device and the transmission units. By means of such a monitoring device, a plurality of interface devices can also be monitored centrally. On the basis of the deviation signals generated by the comparison devices of the individual interface devices, a total error state of the circuit arrangement as a whole can then also be evaluated by the monitoring device. In the event that the total error state meets a predetermined criterion, that is, the reliable operation of the circuit is no longer guaranteed, then a protective measure can be initiated. This may be, for example, outputting a warning signal that indicates to a user of the circuit arrangement that the impairment of the circuit arrangement due to the environmental influences is too great. Similarly, an operation of the circuit Order to be interrupted. Likewise, a reset of individual transmission units or entire interface devices can be provided in the manner described. In this context, when using a monitoring device, it is also possible to specifically overwrite configuration data in registers of the circuit arrangement. In this case, the correct configuration data are then preferably stored redundantly in the monitoring device in a memory by storing the configuration data three times in the memory.

A particularly preferred embodiment of the circuit arrangement according to the invention achieves the robustness against the disturbing influences on the basis of a Schnittstel- leneinrichtung provided by an FPGA. In this embodiment, a programming device for the FPGA is then also included, which is designed to perform a reprogramming of the FPGA in dependence on the deviation signals generated by the comparison device of the interface devices. This embodiment has the advantage that regardless of the way in which the interface device was disturbed (changing a memory content or destroying an electrical connection, for example in a transistor), the interface device or just a single transmission unit can be reconfigured in terms of circuitry. A component of the programming device can be realized, for example, by the monitoring device described.

Optionally, it may be desirable to minimize the amount of circuitry required to implement the circuitry. One possibility for this is provided by an embodiment of the circuit arrangement in which an interface device has transmission units which are designed for bidirectional transmission, as is the rule in the case of a bus or network interface, for example. Instead of using a comparator on both sides of the transmission In order to be able to compare signals which are to be transmitted as well as received in each case after processing by the transmission units, only one comparison device is provided here, and instead of the second a switching device which is easier to implement. The switching device is now designed to determine, for the first input signal, which has been transmitted in one of the two possible transmission directions, on the basis of the deviation signal generated for this purpose, which of the transmission units operates without error. The switching device then notes which transmission unit was recognized as functional. In the event that a second input signal of the interface device is to be transmitted in the opposite direction of transmission, the transmission device then only supplies the second input signal to this transmission unit without subsequently performing a comparison after the processing of the second input signal. This embodiment of the circuit arrangement is based on the recognition that transmission and reception processes via a bidirectional interface device often occur in quick succession. If, for example, when receiving an external signal it is checked which transmission unit is functioning properly, then this transmission unit can also be used for transmission without further testing when sending out a response signal.

The circuit arrangement according to the invention has proven to be particularly suitable in connection with the use in a control device in a medical device. Accordingly, the invention also encompasses a medical device in which a source radiates radioactive radiation or X-ray radiation and it is necessary in this case to operate a control device of the medical device in an area penetrated by the radiation. According to the invention, this control device has an embodiment of the described circuit arrangement according to the invention. In particular, the circuit arrangement according to the invention is preferably in a medical device with a collimator used, which has an electric motor for adjusting the Kollimatorflügel and in which a control device for controlling the electric motor has an embodiment of the circuit arrangement according to the invention.

In addition to the measurement and control operations, as they are performed by the control device, of course, a processing of the measurement signals and a resulting generation of the control signals is necessary. According to an advantageous embodiment of the medical device according to the invention, such a regulation, i. H. the generation of control signals dependent on a sensor signal, but not in the area penetrated by the radiation. Instead, a control device is arranged outside this area, which then receives a sensor signal from the control unit with the circuit arrangement according to the invention from a sensor in the irradiated area and also a control signal generated according to the control method to the sensor signal again via the control unit to a Actuator, such as a motor transmits. This has the advantage that the circuit complexity for that part of the medical device, which must be robust against the influence of radiation, can be kept relatively low. The invention also includes embodiments of the method according to the invention, which have features as they have already been described herein in connection with the developments of the inventive circuit arrangement. For this reason, the corresponding features of the further developments of the method according to the invention will not be explained again here.

In the following, the invention will be explained again with reference to concrete embodiments. This shows:

1 shows a diagram of embodiments of the inventive medical device and a block diagram of a preferred embodiment of the medical Ge inventive device. In the examples explained below, the described components of the medical devices each represent individual features of the medical devices, which are to be considered independently of one another, which also further develop the medical devices independently of each other and thus also individually or in a combination other than that shown To be considered invention.

In FIG. 1, three variants 10, 12, 14 of a control structure for a medical device are shown in which a region 16, which is penetrated by an influence disturbing electronic circuits, for example by a radioactive radiation (gamma radiation), has an electric Circuit 18 of the medical device to be operated. The variants 10, 12, 14 differ in complexity regarding the wiring of the components and the necessary

Protective measures to protect the electronic components arranged in the region 16 against the radiation in the region 16. Variants 12 and 12 represent embodiments of the medical device according to the invention.

The electrical circuit 18 may be, for example, one or more sensors or one or more actuators, such as electric motors, or even a combination thereof. In the case shown in FIG. 1, it is assumed that the electrical circuit 18 generates a sensor signal 22 which is to be supplied to a controller 20 and processed by it and to which a voltage signal 24 for an electric motor is to be generated. To improve the clarity of the example, let it be assumed that the medical device is a radiation treatment device for cancer treatment in which a radioactive source in the region 16 radiates radioactive radiation which passes through a collimator whose collimator Torblätter can be pivoted by the electric motor 18 of the electric circuit. It is further assumed here that a position of a collimator blade is detected by a position sensor whose sensor signal represents the sensor signal 22. The sensor signal 22 is converted by an analog-digital converter 26 into a digital position signal 28, which is processed by the controller 20 as the actual position signal. The voltage signal 24 for the electric motor is generated by an inverter 30. Switching sequences of the inverter 30 are hereby predetermined by a pulse width modulator 32, which receives a digital modulation signal 34 from the controller 20 as a control signal and generates therefrom an analog pulse-width-modulated switching signal 36 for the inverter 30. A set point 40 for the position of the collimator blades is generated by a trajectory planning 40 and transmitted to the controller 20.

The regulator 20, the pulse width modulator 32 and the analog-to-digital converter 26 can be electronic circuits, such as a DSP (digital signal processor), application specific integrated circuit (ASIC), FPGA or a microcontroller can be provided. The Traj ektorienplanung 40 can be realized, for example, as a program on a computer. The computer, or in general the trajectory planning 40, is located in all three variants 10, 12, 14 of the medical device in a radiation-free zone 42, which may be shielded from the irradiated region 16 by a radiation shield 44. In the variant 10 of the medical device, it is necessary to shield the calculation units of the controller 20, so its electronic circuits, against the radiation. In the variant 12, in contrast, the controller 20 transmits the digital modulation signal 34 via a data bus 46. For this purpose, the data bus 46 preferably has a bandwidth of several 100 MB to more than 1 GB. It can, for example, be designed according to the Ethernet standard. The Traj ektorienplanung 40 and the controller 20 can in the case of variant 12 in common be implemented in the computer 48. The digitized measured values of the analog-to-digital converter 26 can also be transmitted to the controller 20 via the data bus 46. Variation 12 has the advantage that only components which are structurally relatively simple, namely the pulse-width modulator 32, the inverter 30 and the analog-to-digital converter 26, can be influenced by the radiation in the region 16.

In variant 14, all digital components are arranged in the radiation-free zone 42. Only the analog measurement signal, i. the sensor signal 22, and the analog pulse width modulated switching signal 36 are transmitted through the shield 44 back into the area 16. Advantage of this variant is that in the area 16 only analog voltage signals exist, in which there is little probability that they are disturbed by the radiation so that it comes to a malfunction of the medical device. A disadvantage of the variant 14, however, is that the wiring complexity increases with the number of sensors and electric motors used.

On the other hand, based on the invention, variants 10 and 12 can be implemented with less circuit technology, and nevertheless a robust operation of the medical device against the radiation in region 16 can be made possible.

Preferred here is the variant 12, which is described in more detail in connection with FIG. FIG. 2 once again shows the computer 48 which is connected via the data bus 46 to an electronic circuit 50 located in the region 16, which comprises the analog-to-digital converter 26 and the pulse width modulator 32. The electronic circuit 50 further comprises a network interface 52 for data exchange with the data bus 46. A monitoring device 54 of the electronic circuit 50 monitors the analog-to-digital converter 26, the pulse width modulator 32 and the network interface 52. The electronic circuit 50 can be realized, for example, by an FPGA, in which individual circuit parts can also be realized as an ASIC.

Of the electrical circuit 18, the electric motor 18 'and a position sensor 18' 'for a rotational position of the electric motor 18' are shown in FIG 2. The rotational position corresponds to the position of a collimator blade movable by the electric motor 18 '. The sensor 18 "may, for example, be a potentiometer.

The analog-to-digital converter 26, the pulse width modulator 32 and the network interface 52 each represent interfaces over which the electronic circuit 50 exchanges a signal with external lines. In FIG. 2, the reference numerals of these lines correspond to those of the sensor signal 24, of the analog switching signal 36 or of the data bus 46. The analog-to-digital converter 26 processes the sensor signal 24 into the digital measuring signal 28. By means of the pulse width modulator 32, the digital modulation signal 34 is processed and from this the pulse width modulated switching signal 36 is generated. The network interface 52 transmits the digital measurement signal 28 to the computer 48 over the data bus 46 and conversely receives the digital modulation signal 34 from the data bus 46.

For a robust operation against the influence of the radiation in the region 16, by means of which individual bit values can be changed, for example, in configuration registers and thereby the behavior of the interfaces 26, 32, 52 can be changed, each of the interfaces 26, 32, 52 for the Transmission of signals in each case three transmission units. The network interface 52 includes three MAC blocks 56, each of which may be implemented as ASIC blocks in the FPGA. Each MAC block 56 may be coupled to its own ECC block 58, by which the signal of the respective MAC block 56 is error-corrected. Everyone MAC block 56 represents, optionally in combination with its ECC block 58, a transmission unit. The corrected bit streams 60 are supplied to compare and evaluate logic, here referred to as voter 62 (selector). The voter 62 may be realized, for example, by a logic circuit. The first task of the voter 62 is to compare the three bit streams 60 and to decide which signal should be turned on at an output 64 of the voter as an output signal. For comparison, the voter 62 has a comparison unit (not shown in more detail). A selector unit (not shown) of the voter 62 makes a majority decision based on the result of the comparison: If two of the bitstreams 60 have identical signal characteristics, and only one of the bitstreams 60 deviates from the other two, the two identical bitstreams 60 provide the majority and one of the two identical bit streams 60 are forwarded to the output 64 as the output of the network interface 52. The second task of the voter 62 is to generate a restart signal RST (Reset) on a reset line 66 in the event that a deviation is detected between the three bit streams 60 by the comparison unit. In FIG 2, two variants are illustrated for this purpose. On the one hand, the reset line 66 can lead directly to the MAC blocks, for example to the corresponding ASIC, and thus trigger a restart of the MAC block 56 which has generated the deviating bit stream 60. The reset line 66 may also lead to the monitoring device 54, which in this way collects information about malfunctioning components of the electronic circuit 50 and thus observes the fault condition of the entire electronic circuit 50. It can be provided that the monitoring device 54 then triggers the restart by itself via a signal line 68 or generates a warning signal which is transmitted via the signal line 68 to the network interface 52, which then transmits it via the data bus 46 to the computer 48 is transmitted. Another possibility is that through the Monitoring device 54 configuration data for the ASICs of the MAC blocks 56 from a memory (not shown) of the monitoring device 54, in which the configuration data redundant, for example, three times stored, via the signal line 68 in configuration register of the MAC blocks 56, in particular the in his Operation of malfunctioning MAC block 56 transmits. In the event that the monitoring device 54 recognizes that the functionality of the electronic circuit 50 is limited to a predetermined greater extent, the monitoring device 54 may also cause a programming circuit (not shown) to re-assign a part or the entire FPGA program. The bit stream output by the voter 62 at the output 64, ie the digital modulation signal 34, is received by the pulse width modulator 32 and processed there by three pulse width modulation blocks 70. Each pulse width modulation block 70 represents a transmission unit. The pulse-width modulation blocks 70 can also be implemented as an ASIC. The three analog pulse width modulated signals 72 generated by the pulse width modulation blocks 70 are compared in a further voter 74 by a comparison device. The voter 74 may have a similar structure to the voter 62. The pulse width modulated analog signals 72 have discrete voltage jumps, so that the voter 74 similar to the digital streams 60 processing voter 62 for comparing the analog signals 72 may have comparable logic as the voter 62. From the voter 74, the analog signal 72 is output as the analog pulse width modulated switching signal 36 to the inverter 30, which coincides with the majority of the signals 72 generated by the pulse width modulation blocks 70. Also in the voter 74 may be provided to generate a reset signal on a reset line 76, which then either to the immediate

Restarting a pulse width modulation block 70 which is disturbed in its function, or can be performed as such. monitoring signal can be transmitted to the monitoring device 54.

The sensor signal 22 relating to the rotational position of the electric motor 18 'measured by the sensor 18 "is subjected in parallel to an analogue-to-digital conversion by three converter blocks 78. Each transducer block 78 represents a transmission unit. The transducer blocks 78 may be implemented as an ASIC. The digitized measured values 80 of the three converter blocks 78 are compared by another voter 82. The voter 82 corresponds in its mode of operation to the voter 62. The respectively prevailing majority value is transmitted as the actual measured value 84 to an error correction code 86 (ECC). A reset line 88 emanating from the voter 82 can again directly transmit a reset signal for a reset of the individual converter blocks 78 or of all the converter blocks 78 if a difference between the digitized measurement signals 80 is detected. In the same way, the voter 82 can be coupled to the monitoring device 54 via the reset line 88. The digital measurement signal 28 generated by the error correction coding 86 is transmitted to the network interface 52. In this case, it can be provided that all MAC blocks 56 generate a bus signal on the data bus 46 in the form of a time-division multiplex signal for the sequence of digitized measured values 28, so that the computer 48 receives the actual measured values 84 in triplicate.

In many cases, however, it may be sufficient that the digital measurement signal 28 is output on the data bus 46 only by a MAC block 56. This can be exploited that a measurement by the sensor 18 '' and the corresponding generation of the digital measurement signal 28 always takes place promptly to a specific digital modulation signal 34 through which the rotational position of the electric motor 18 'is changed. Upon receipt of the digital modulation signal 34 by the voter 62, a check of all MAC blocks 56 has already taken place. It can therefore be provided that only a specific one of the MAC signals is available for transmitting the digital measurement signal 28. Blocks 56 is used as the sole transmission block and it is checked here whether this MAC block 56 has been recognized as functional in the last reception process by the voter 62. It is more flexible if the digital measuring signal 28 is optionally supplied to a MAC block 56 by the monitoring device 54 by means of a switching device (not shown) which has been recognized as being functional by the voter 62 during the last receiving process.

Overall, the examples illustrate how, for example, in an FPGA, input and output interfaces which are exposed to the influence of interfering radiation can be effectively made more robust in their operation and thus a falsification of the data processed by these interfaces can be avoided can. This overall improves the availability of the circuit protected in this way, since the redundant design, even in the presence of a fault in some of the transmission units, makes it still possible to identify which signals have been processed correctly.

Claims

claims

A circuit arrangement (50) comprising an electronic circuit (26, 32, 52) and at least one interface device (26, 32, 52) adapted to connect the electronic circuit (26, 32, 52) to an external signal line (24, 36, 46), the interface means (26, 32, 52) for this purpose having a transmission unit (56, 70, 78) adapted to receive an input signal (46, 34, 24) and to process the input signal is, characterized in that

the interface device (26, 32, 52) has at least two further transmission units (56, 70, 78) of the aforementioned type and the signal inputs of all transmission units (56, 70, 78) are designed to receive the same input signal (34, 24) and all the transmission units (56, 58, 70, 78) are coupled directly or indirectly to a comparator (62, 74, 82) which is adapted to receive the signals (60, 72, 80) processed by the transmission units (56, 70, 78). and to signal a deviation between the compared signals (60, 72, 80) by a deviation signal.

2. Circuit arrangement (50) according to claim 1, wherein all transmission transmission units (56, 70, 78) with a selection circuit

(62, 74, 82) adapted to generate an output signal (34, 36, 84) upon signaling a deviation by the comparing means (62, 74, 82) which is coupled to a majority of the compared signals (60 , 72, 80).

3. Circuit arrangement (50) according to claim 1 or 2, wherein a restarting device (54, 62, 66, 74, 76, 82, 88) is provided, which is designed, when signaling a deviation by the comparison device (62, 74, 82) to generate a reset signal (RST) and thereby in at least that transmission unit (56, 58, 70, 78) whose processed signal (60, 72, 80) differs from the majority of the compared signals (60, 72, 80) to trigger a restart.

4. Circuit arrangement (50) according to one of the preceding arrival claims, wherein the circuit arrangement (50) has a monitoring device (54) which with the respective comparison means (62, 74, 82) of the at least one

Interface device (26, 32, 52) is coupled and which is adapted to observe based on the deviation signals a total error state of the circuit arrangement (50) and to initiate a protective measure in the event that the total error state meets a predetermined criterion.

5. Circuit arrangement (50) according to claim 4, wherein the

A protective measure comprises at least one of the following steps: the issuing of a warning signal, the interruption of an operation of the circuit arrangement (50), the overwriting of configuration data in registers of the circuit arrangement (50).

6. Circuit arrangement (50) according to one of the preceding claims, wherein at least one interface device (26, 32, 52) is provided by a FPGA and the circuit arrangement a programming device for the FPGA comprises and the programming device is designed to, depending from the deviation signal of the comparing means (62, 74, 82) of the interface means (26, 32, 52), reprogramming a part of the FPGA or the entire FPGA.

7. Circuit arrangement (50) according to one of the preceding claims, wherein at least one interface device (52), the transmission units (56) are designed for bidirectional transmission and a switching device (54) is provided, which is adapted to one in a transmission direction (56) transmitted first input signal to receive the deviation signal of the comparator (62). and to supply a second input signal (28) to be transmitted in the other transmission direction to that transmission unit for which the deviation signal indicates that the processed signal produced by the transmission unit (56) to the first input signal belonged to the majority of the compared signals.

8. Circuit arrangement (50) according to one of the preceding claims, wherein at least one interface device (52) is designed as a bus or network interface and in this case each transmission unit (54) comprises a MAC device (56) and preferably also an ECC device (58 ) having.

9. Circuit arrangement (50) according to one of the preceding arrival claims, wherein at least one interface device (32) designed to generate a pulse width modulated output signal (36) and in this case each transmission unit (70) comprises a pulse width modulator.

10. Circuit arrangement (50) according to one of the preceding claims, wherein at least one interface device (26) comprises transmission units with an analog-to-digital converter.

11. A medical device which has a source of radioactive radiation or X-radiation and in which an adjusting device (50) is arranged in an area penetrated by the radiation of the source,

characterized in that

the adjusting device (50) has a circuit arrangement (50) according to one of the preceding claims.

12. Medical device according to claim 11, which has a collimator with at least one adjustable collimator wing, wherein for adjusting an electric motor (18 ') is provided and the adjusting device (50) for controlling the electric motor (18') is set up.

13. A medical device according to claim 11 or 12, comprising a regulator means (20) disposed outside the radiation penetrated region (16) and adapted to be driven by a sensor (18 '') in the region (60). via the adjusting device (50) to receive a sensor signal (28) and to generate a control signal (34) to the sensor signal (28) and the actuating signal (34) via the control device (50) to an actuator, in particular a motor (18 ') , transferred to .

14. A method for detecting an erroneous functioning of a transmission unit (56, 58, 170, 78) of an interface device (26, 32, 52), by which in a circuit arrangement (50) a signal between an electronic circuit (26, 32, 52) and a signal line (24, 36, 46), characterized by the steps of:

- Providing at least two further transmission units (56, 58.70, 78) of the same kind in the interface device (26, 32, 52);

- parallel processing of the signal to be transmitted by the total of at least three transmission units (56, 58, 70, 78);

Comparing the processed signals (60, 72, 80) of all transmission units (56, 58.70, 78).