T 1820/23 31-10-2025

1. Sufficiency of disclosure - Article 100(b) EPC

1.1 Claim 1

With respect to sufficiency of disclosure of the invention in claim 1, the appellant submitted two lines of argument summarised in points 1.1.1 and 1.1.2 below.

1.1.1 The term "to diagnose" in Features c-bis and e of claim 1 originated from the field of medicine and meant assigning a set of recorded symptoms to a clinical picture. Although a "clinical picture" could be quite broad, a medical diagnosis always included at least some kind of classification, for example according to the type of disease or the affected part of the body, not just a statement as to whether the patient was ill. The diagnosis was made for the purpose of therapy and thus had to be documented (stored) or made available (displayed) for further use. Applied to the current context, Features c-bis and e not only required detecting the presence or absence of a failure but also additional information about its type, cause or the affected functions. Moreover, claim 1 specified who performed the diagnosis, namely the controlling part and the monitoring part, each of which diagnosed a failure of the other part. Accordingly, self-diagnosis or merely being informed whether the other part has a failure or not did not fall within the terms of claim 1.

However, the only example in the patent of how the failure diagnosis can be implemented in paragraphs [0101] to [0105] and Figure 6 disclosed that the monitoring and controlling parts merely received a digital signal representative of the presence or absence of a failure of the other part. How this was indicative of a failure was not explained. The monitoring and controlling parts did not perform an independent diagnostic activity apart from reading the digital signal, and no further diagnostic information other than the presence or absence of a failure was disclosed.

It was correct that in view of G 1/24, the above-mentioned embodiment of the description was to be consulted for interpreting claim 1, but this did not allow disregarding the explicit wording of claim 1 ("configured to diagnose a failure") in view of the primacy of the claims as the starting point and basis for assessing patentability. This was even more so as in the example of Figure 6, the monitoring part just "converted" and routed through the signals and did not monitor or diagnose anything, not even itself. When interpreting the claim with a mind willing to understand, the skilled person would have understood that safety was to be improved by means of a reciprocal diagnosis. However, this was not fulfilled if the controlling part performing self-diagnosis was not diagnosed by the monitoring part, and the monitoring part merely routed through the signal received from the controlling part. There was thus no mutual or reciprocal diagnosis. The example of Figure 6 did not improve safety, either, for the following reasons. As the first to third signals were digital signals and the function of the monitoring part resided only in the "conversion" of these signals, the provision of the monitoring part and diagnosis of the monitoring part merely added complexity compared to when the non-inverted first signal was used directly for controlling the driving part (without a monitoring part). If, however, the function of the monitoring part was to invert the first signal, this meant that the second signal was normally low - which was also the case if the monitoring part had a failure. Hence, in both cases, no improvement of safety was achieved. The skilled person would thus rule out an interpretation of claim 1 that did not provide the desired effects and did not solve the stated problem.

Accordingly, the only example of failure diagnosis in the patent in paragraphs [0101] to [0105] and Figure 6 did not fall within the terms of claim 1. There was thus not even a single workable example for the claimed configuration "to diagnose a failure" of the other part. There was no mention of the nature, type or class of the failure that was diagnosed, either. Accordingly, the patent did not sufficiently disclose how to carry out Features c-bis and e of the invention.

1.1.2 Even assuming that receiving a first signal from the controlling part and the conversion and forwarding of this signal to the driving part and back to the controlling part fell within the scope of claim 1, the patent did not sufficiently disclose the invention.

Firstly, paragraph [0101] to [0105] and Figure 6 merely disclosed that a low level of a first signal was indicative of a failure of the controlling part but did not provide any explanation. It did not disclose self-diagnosis of the controlling part. Likewise, the patent did not disclose how the controlling part could diagnose the monitoring part based on a "converted" signal received from it. The skilled person was thus left in the dark as to how this example could be reduced to practice in a meaningful manner.

Secondly, even if it were accepted that the patent referred to a self-diagnosis as submitted by the respondent (although the monitoring part in the example of Figure 6 could not even perform a self-diagnosis), it was disputed that the implementation of self-diagnostic functions was part of the common general knowledge in the field of control systems for sanitary washing devices.

Documents D7 to D13 submitted with the respondent's letter of 30 September 2025 should not be admitted under Article 13(2) RPBA. The question of how the self-diagnostic signals could be implemented had already been raised in the grounds of appeal (paragraph bridging pages 19 and 20). There were no exceptional circumstances for admitting these documents. D7 and D12 represented common general knowledge but were not relevant for the question at issue. D8 to D10 related to specialised high-performance microcontrollers for safety-critical applications in the automotive field which did not belong to the common general knowledge in the field of the patent. Moreover, paragraph [0051] referred to a "microcomputer" or CPU as the controlling part, not to more complex architectures as in D8 to D10. D11 and D13 related to watchdog timers, which were incompatible with the embodiment of Figure 6 and were not mentioned in the patent.

1.2 The respondent argued that the term "to diagnose" in claim 1 had to be understood as "to determine the presence or absence of a failure" according to paragraphs [0091] and [0093] of the patent. The analogy with a medical diagnosis was limited, and claim 1 did not require a more detailed result (regarding types, causes or affected functions) or independent tests. The embodiment of paragraphs [0101] to [0105] and Figures 4 to 6 fell within this understanding as the controlling and monitoring parts determined the presence or absence of a failure of the respective other part based on a digital signal received from it.

Although "self-diagnosis" was not explicitly mentioned in the patent, the skilled person understood that this was implicit in the embodiment of Figure 6 due to the binary output from the controlling part being indicative of the presence or absence of a failure. This had also been submitted by the appellant itself in the grounds of appeal. The same could also be implemented in the monitoring part. However, according to the example of paragraph [0105], diagnosis of the monitoring part could be carried out by the controlling part based on whether the converted third signal output from the monitoring part corresponded to the expected response to the first signal. In any case, the parts were configured to recognise or determine the presence or absence of a failure of the other part and thus to "diagnose" each other within the meaning of the patent, irrespective of whether this provided improved safety or whether the same level of safety could have been achieved without a monitoring part.

Whether the skilled person was enabled to implement a self-diagnosis function as disclosed in the embodiment was for the first time questioned in the Board's communication under Article 15(1) RPBA. In response, the respondent submitted documents D7 to D13 to establish that the signal exchange and self-diagnostic functionality was part of the skilled person's common general knowledge and even commercially available before the date of filing of the patent application. This evidence was thus not late filed and had to be admitted.

Accordingly, the patent disclosed the invention of claim 1 in a manner sufficiently clear and complete for it to be carried out by a person skilled in the art.

1.3 Interpretation of "to diagnose"

1.3.1 The Board largely agrees with the appellant's understanding of the term "diagnosis" in medicine. However, when transferring this term to another technical field, the question arises as to the extent and limits of the analogy.

Diagnosing failures in a control system in the present context is not for corrective or therapeutic purposes but serves as a safety shut-off feature ("prohibit at least one of heating in the heating part and jetting from the nozzle" in Features d and f). For this purpose, it is not necessary to have more detailed information about the type, cause or the affected functions of the monitored part; it is sufficient for initiating the shut-off function to recognise whether the respective part has a failure or not.

This understanding derived from the claim alone is in line with the description in paragraphs [0090] to [0093] of the patent relating to the flow chart of Figure 5 and equating "failure diagnosis" (steps S202 and S206) with "determining the presence or absence of a failure". It is also not necessary for the claimed purpose that the result be stored or displayed as it is immediately used for the above-mentioned shut-off function. Accordingly, the term "to diagnose" in the context of the patent refers to a rather basic determination that is less sophisticated than the intellectual diagnostic decision-making in medicine to which the term alludes.

Moreover, the subjects performing diagnosis in the current case are deterministic circuits or logic ICs that cannot be expected to carry out a self-determined "intellectual" decision-making as a practitioner does in medicine. The diagnosis and initiation of the consequences by these devices does not go beyond digital signal processing and predetermined logic operations. It is thus less important who performs the actual diagnosis. That the monitoring part "diagnoses" a failure in the controlling part means nothing more than that it determines or recognises the absence or presence of such a failure. This is already fulfilled by detecting a signal indicative of the presence or absence of a failure - it does not necessarily require carrying out dedicated tests on the other device.

1.3.2 The example of Figure 6

This understanding is supported by the example of paragraphs [0101] to [0105] and Figure 6. Although the respondent submitted that also the flow charts of Figures 4 and 5 and further passages in the patent disclosed the claimed "failure diagnosis", the passage of paragraphs [0101] to [0105] and Figure 6 is the only example in the patent that discloses in more detail how failure diagnosis is carried out. In this example, the configuration to diagnose a failure of the other part is based on the exchange of signals indicative of the presence or absence of a failure. Accordingly, with the understanding of "to diagnose" set out above, the example of Figure 6 falls within the claimed configuration "to diagnose a failure" of the respective other part and thus confirms this understanding.

Moreover, even if there were still doubts as to whether the reception of a signal from the other part represents a "diagnosis" of the other part in view of the fact that the claimed expression defines the receiving part as the active component which performs the diagnosis on the other part, in accordance with G 1/24 (Headnote), the "description and drawings shall always be consulted to interpret the claim". In the Board's view, this statement made in the context of "assessing patentability of an invention under Articles 52 to 57 EPC" in G 1/24 also applies for assessing whether the invention as claimed is sufficiently disclosed under Articles 100(b) and 83 EPC.

Contrary to the appellant's arguments, the understanding that "to diagnose" includes the basic case of determining the result of a self-diagnosis from the monitored part also does not violate the principle of the primacy of the claims as they remain "the starting point and basis" for the assessment (see G 1/24, Reasons 12 and Headnote; see also UPC_CoA_335/2023, Headnote 2, according to which the claims are the "decisive basis"), as set out above. The adopted interpretation merely serves to provide a meaning to a feature which forms part of the claim and this is appropriate in view of the question about the extent and limits of the analogous understanding of the term "to diagnose" borrowed from medicine. This interpretation of the meaning of a feature that forms part of the claim is allowable and must be distinguished from reading limiting features into the claim which are not present in the claimed subject-matter.

1.3.3 Reciprocal diagnosis and improvement of safety

The appellant submitted that the example of paragraphs [0101] to [0105] and Figure 6 did not represent a mutual diagnosis, did not improve safety and would thus not be considered a proper basis for interpreting the claimed subject-matter by the skilled person.

It is true that the skilled person understands from Features c-bis and e that the controlling part and the monitoring part perform mutual, reciprocal diagnosis, and from Features d and f that the purpose is to improve safety by the claimed shut-off function (see point 1.3.1 above). In the Board's view, the example of Figure 6 implements this concept as set out in the following and would thus be considered when interpreting the claim.

According to paragraph [0104], a "first signal" is output from the controlling part to the monitoring part. The first signal can be a digital flag indicating the presence (by a "Low" level) or absence (by a "High" level) of a failure in the controlling part. It is true that the patent does not explicitly disclose that the first signal corresponds to a self-diagnosis of the controlling part as submitted by the respondent. Indeed, a "Low" level could, for example, also be due to a local power issue at the controlling part (in which case it would still indicate a failure). However, as argued by the respondent, the skilled person would also have considered that a binary signal representative of the presence or absence of a failure can be the result of self-diagnosis functionality of the controlling part, as also assumed by the appellant (point 4.1.3 on page 19 of the statement setting out the grounds of appeal). In any case, the example discloses that the monitoring part recognises the presence or absence of a failure of the controlling part based on the first signal. With the understanding of "to diagnose" set out above, this discloses a configuration "to diagnose a failure of the monitoring part" (Feature c-bis).

According to paragraph [0104], the monitoring part "converts" the first signal to a "second signal" which it then outputs to the driving part for controlling the water supply. What exactly is meant by "converting" is not specified. But considering that the monitoring part can, in its most basic implementation, without being limited to it, be a simple logic IC (paragraph [0103]), the output of the "conversion" of the binary first signal could be as simple as the logic identity or inversion of the first signal. It is clear to a skilled person how the digital second signal obtained in this way is used for controlling the "driving part" to "prohibit [...] jetting from the nozzle" (Feature d).

According to paragraph [0105], the monitoring part further "converts" the first signal into a third signal "like the second signal" and "outputs the third signal [...] to the controlling part" and, "[t]hus, a failure of the monitoring part [...] is diagnosed". From these short statements, the skilled person understands that the diagnosis of a failure of the monitoring part by the controlling part may work in the same way as explained for the reciprocal diagnosis in paragraph [0104]. That is, the controlling part is configured to diagnose a failure of the monitoring part depending on the signal level of the third signal received from the monitoring part. In the most basic implementation considered above, in which the monitoring part does not perform a self-diagnosis but merely a conversion of the first signal, the third signal is a digital signal of the same or an inverted level of the first signal (in fact, Figure 6 seems to disclose that the second and third signals are identical), and the determination of a failure consists in the determination of whether the monitoring part outputs the expected signal level. Hence, this example discloses how Feature e can be implemented. That and how the shut-off function of the controlling part according to Feature f can be implemented were not in dispute.

From the above, it can be seen that the example of Figure 6 falls within the wording of Features c-bis to f and thus discloses one way of carrying out the invention. With the understanding of "to diagnose" as set out above, the example thus discloses a mutual, reciprocal diagnosis between the controlling and monitoring parts, contrary to the appellant's allegation. The fact that a failure of the controlling part can be detected and responded to with a shut-off function increases safety. An increase in safety is already achieved if only some kind of potential failure is detected. It is not necessary that all possible failures can be recognised. Likewise, verifying the response from the monitoring part can at least detect some kinds of failures in the monitoring part, namely those leading to a wrong, unexpected converted third signal. It is true that in the variant of the above-mentioned simplest case where the signal conversion is an inversion, i.e. the expected level of the third signal is "Low" when the first signal is "High", a failure in the monitoring part's power supply cannot be detected (the third signal would then always be "Low"). However, a failure in the opposite direction, i.e. the third signal is "High" although it should be "Low", can be determined, and the response by shutting off the heating or shower function by the controlling part further increases safety.

The question of whether the same or even a higher level of safety could have been achieved by transmitting the first signal directly to the driving part without involving a monitoring part at all (such that failures of the latter are excluded and need not be monitored) is immaterial for whether the example of Figure 6 falls within the claimed subject-matter. There is thus no reason why a skilled person would not have considered the example of Figure 6 a proper implementation of the invention as claimed.

1.4 Sufficiency of disclosure of "to diagnose"

1.4.1 As reasoned in points 1.3.1 and 1.3.2, claim 1 does not require that the controlling part and the monitoring part perform a self-sufficient diagnosis on the other part; receiving a digital signal indicative of a failure from the other part fulfils Features c-bis and e. Likewise, no further diagnostic information other than the presence or absence of a failure is required, and claim 1 does not imply storing or displaying the result of the failure diagnosis. Accordingly, the absence of disclosure in the patent regarding these aspects (see point 1.1.1) does not constitute insufficient disclosure of the claimed invention.

1.4.2 As set out in point 1.3.3, the skilled person understands how the first signal and the third signal in the example of paragraphs [0101] to [0105] and Figure 6 can be indicative of a failure even without a more specific explanation in the patent. The skilled person would have understood that the first signal can be implemented as the output of a self-diagnosis capability of the controlling part. Accordingly, the objections summarised under "firstly" in point 1.1.2 above are not convincing.

1.4.3 Admittance of D7 to D13

In its preliminary opinion in the communication under Article 15(1) RPBA, the Board questioned sufficiency of disclosure as it was not disclosed "how the signals Sig 1 and Sig 3 are generated and how their output level is indicative of a failure" even if it was accepted that evaluation of a flag indicative of a self-diagnosis of the other part fell within the terms of the claim (section 6.4, third and fourth paragraph on page 7).

With the letter of 30 September 2025, after notification of the Board's communication, the respondent submitted documents D7 to D13 as evidence for the commercial availability of microcontrollers with integrated self-diagnosis functions and the common general knowledge of how to implement this. It set out that this submission was a response to the Board's communication and should thus be admitted.

The appellant disagreed and submitted that this question had already been raised in the statement setting out the grounds of appeal (section 4.1.3, in particular, paragraph bridging pages 19 and 20).

In the referenced passage, the appellant criticised that paragraphs [0104] and [0105] did not state how the self-performed failure detection actually took place ("wie diese Fehlererkennung eigentlich stattfindet"). This criticism was subsequently explained in more detail, namely as relating to the distribution and separation of functionality within the part and the question of how a defective component can reliably assess its own failure and that it had to be specified if only certain failures or parts of the component were subject to the self-diagnosis. The respondent replied to this criticism by referring to Figure 3 and paragraph [0075] of the patent disclosing the separation of the controlling part into different dedicated functional parts. In any case, the Board agrees with the respondent that the appellant's objections in the written proceedings did at least not clearly relate to the question of whether it was sufficiently disclosed how a self-diagnostic function in general can be implemented taking into account the common general knowledge in the field.

This issue was thus for the first time addressed in the Board's communication, this representing exceptional circumstances for admitting D7 to D13, which were a direct response to this new issue, into the appeal proceedings under Article 13(2) RPBA.

1.4.4 At least D13 (a Wikipedia article) is of a general nature and not restricted to specialised high-performance circuits for safety-critical applications such as in the automotive field. This document belongs to the common general knowledge regarding general safety features in control systems. Although the safety requirements for shower toilet systems are not comparable to those in life-critical applications, the risk of scalding requires adequate safety management. Therefore, the content of D13 was common general knowledge of a skilled person in the field of control systems for a sanitary washing device as in the case at hand, which may suffer from failures of hardware or software components just as any control system.

D13 relates to the concept of "watchdog timers" as a possible means for the detection of failures in hardware and software components (see D13, section "Fault detection"). The general principle is that the watchdog timer performs a countdown that is regularly restarted by the monitored component when operating normally. A failure of the monitored component, for example due to a hardware fault or software error, is detected if no reset is received before the timeout. A watchdog timer can, inter alia, be used to activate a fail-safe state (D13, section "Corrective actions") and can be implemented as a hardware component or software routine.

It is true that the patent does not disclose a watchdog timer and that monitoring of the constant "first signal" in the example of Figure 6 is not compatible with the application of a watchdog timer on the side of the monitoring part. However, as also disclosed in D13 (see section "Architecture and operation"), a watchdog timer can be an integrated on-chip component, thus implementing a self-diagnosis. In this manner, the "first signal" in the example of Figure 6 could be implemented by the timeout signal of an internal watchdog timer. The concept of a watchdog timer is also one way of carrying out a diagnosis of the other component according to the invention beyond the basic example of Figure 6.

As the concept of a watchdog timer and its implementation and application for implementing a self-diagnostic function belongs to the common general knowledge of the skilled person in the field of the patent, as evidenced in particular by D13, the skilled person is enabled to carry out the invention both according to the example of Figure 6 and in a more general sense without any more specific disclosure in the patent. Therefore, the objections summarised under "secondly" in point 1.1.2 above are not convincing either.

1.4.5 Accordingly, the patent discloses the invention of claim 1 in a manner sufficiently clear and complete for it to be carried out by a person skilled in the art.

1.5 Claims 6 to 9

1.5.1 The appellant submitted that the patent did not sufficiently disclose how the invention of claim 6 could be carried out over the whole claimed breadth.

Claim 6 defines that water supply to the nozzle of the shower toilet is controlled by a "water supply controlling part" (431) driven by a "driving part" (51). The controlling part is configured to diagnose a failure of the driving part and to prohibit water supply to the nozzle by the water supply controlling part when the driving part fails.

The appellant submitted, firstly, that the claimed subject-matter was not understandable and thus could not be carried out. For example, it was not clear how the water supply by the water supply controlling part could be prohibited if the part driving it failed and how the controlling part could prohibit the water supply if it was under the control of a different dedicated water supply controlling part. It was also not clear why this was necessary if the driving part of the water supply controlling part driving the water supply was defective.

Secondly, the detailed example of Figure 7 and the corresponding description did not disclose diagnosis of a failure of the entire driving part but only a partial failure. The control only worked if there was a redundant second feature in the driving part like the second switch in series in Figure 7 that still worked. This was not required in claim 6, but it was not sufficiently disclosed how to implement the invention without a second switch in series or in the case of a complete failure of the driving part (e.g. when both switches failed). Likewise, how the invention could be implemented if the water supply controlling part was not an electromagnetic valve but an actual controller was not disclosed. Accordingly, the subject-matter of claim 6 was not workable over the full breadth of the claim.

1.5.2 This is not persuasive.

As to the issues summarised under "firstly" in point 1.5.1 above, paragraphs [0106] to [0113] and Figure 7 disclose a workable example that explains how claim 6 is understood. In this example, the "water supply controlling part" is an electromagnetic valve (see paragraph [0037]). The "driving part" includes two electrically controllable switches in series, by which the voltage level at the valve is controlled - it is pulled down to ground when both switches are closed, thus opening the valve, paragraphs [0108] and [0109], Figure 7). Paragraph [0113] discloses that a failure can be sensed based on a signal SigB representative of the electric potential at the valve (or the potential drop across the driving part). At the time of failure diagnosis, the controlling part can turn on/off each switch. The skilled person thus understands how, in this way, a failure of each switch can be detected. This example thus provides an answer to each of the appellant's questions as to the understanding of claim 6 above.

Moreover, it shows that a failure of each switch can be determined, and the diagnosis is thus not restricted to only a partial diagnosis of the driving part. However, the disclosed shut-off functionality in the example can only be carried out if one switch can still be opened.

It is true that claim 6 does not specify each detail of the embodiment of Figure 7.

However, the appellant's objection primarily amounts to an alleged lack of essential features under Article 84 EPC that cannot be examined in opposition appeal proceedings, in accordance with G 3/14.

It is normal that claims are more general than the detailed embodiments in the description. It is therefore very easy to find embodiments that are covered by the claims but cannot be put into practice for various reasons. This is, however, not prejudicial to sufficiency of disclosure as long as the skilled person is aware of this and knows how to arrive at workable embodiments (see G 1/03, Reasons 2.5.2; Case Law of the Boards of Appeal, 11th edn. 2025 (in the following: Case Law), II.C.5.4 b), second last paragraph).

This is the case here. The claimed functionality is not overly complicated. If a failure in the driving part (regardless of its structure) is detected, the controlling part must still be able to prohibit water supply. This does not require a redundancy by two switches in series. It can be carried out in various other ways, for example via another driving part or by issuing a control signal directly to the water supply controlling part. Accordingly, the skilled person knows several ways of how to carry out the invention of claim 6 substantially over the whole claimed scope.

1.5.3 At the oral proceedings, the appellant confirmed that its objection of insufficient disclosure of the subject-matter of claims 7 to 9 was only due to the dependency on claim 6 and the issue discussed above. As the objection against claim 6 does not hold, claims 7 to 9 are likewise unobjectionable.

1.6 In summary, the ground for opposition under Article 100(b) EPC does not prejudice the maintenance of the patent as granted.

2. Novelty - Articles 100(a), 52(1) and 54 EPC

2.1 The appellant submitted that the subject-matter of claim 1 was not novel over D5.

2.2 It was common ground that D5 discloses Features a and b of claim 1, i.e. a sanitary washing device with a shower function and a controller 7 configured to control the shower function (heating or water supply to the nozzle; e.g. page 1, first to third paragraph; page 7, first paragraph, last sentence).

2.3 D5 discloses that the controller (7) is configured to prohibit jetting from the nozzle (when the water is too hot during cleaning or decalcification procedures, see page 8, second and third paragraphs). Moreover, D5 further proposes, in order to mitigate the risk of scalding, using two redundant temperature sensors (5, 6) and shutting off the shower function when a discrepancy between the sensed temperature values is determined (page 4, fourth paragraph). To even further increase safety, the independent signals of two temperature sensors are processed separately by two independent acquisition units of the controller 7, a microprocessor 8 and a discrete circuit arrangement 9 (see paragraphs bridging pages 4 and 5 and 7 and 8).

2.4 The Board agrees with the appellant that D5 also discloses Feature c since one of the acquisition units (8, 9) can be considered a "monitoring part" separate from the remaining parts of the controller 7, which are configured to control the functions of the shower toilet and can be considered to represent the claimed "controlling part".

2.5 According to page 5, first paragraph, last sentence, by using two separate acquisition units "not only can a failure in a temperature sensor be detected, but also whether any of the elements performing the evaluation, i.e. in this case the microprocessor and the discrete circuit, are malfunctioning". The evaluation of a failure in the temperature sensors or the acquisition units in D5 can be considered a "diagnosis of a failure" within the meaning of claim 1 as set out above. However, D5 does not disclose further details on how this diagnosis is achieved. This is important for determining what can be directly and unambiguously derived from D5, irrespective of whether claim 1 of the patent does or does not specify such details, either.

2.6 According to the fourth paragraph on page 4 in D5, the diagnosis is based on a discrepancy between the redundant temperature measurements. That is, the controller is configured to diagnose a failure in the temperature measurement when the temperature values sensed by the temperature sensors and detected by the acquisition units differ from each other. However, in this way, the controller cannot distinguish whether the failure is in one of the temperature sensors or one of the acquisition units and in which one.

Accordingly, following the assignment in point 2.4 above, D5 does not directly and unambiguously disclose that the controller 7, and thus the "controlling part" identified above, is "configured to diagnose a failure" specifically "of the monitoring part" as defined in Feature e. Moreover, D5 does not disclose that the "monitoring part" identified above is configured to diagnose a failure of the monitoring part. The redundancy of the temperature measurement is different from the claimed reciprocity of the diagnosis. D5 thus also does not disclose Feature c-bis. Accordingly, the prohibition of jetting disclosed in D5 is not based on such diagnostic results, either (Features d and f).

2.7 This result is independent of whether a diagnosis involves mutual communication between the parts as in the example of Figure 6 in the patent or is carried out without mutual communication. It is also independent of how exactly the parts and functionality of the controller 7 are divided into a "controlling part" and a "monitoring part".

2.8 The appellant argued that the term "to diagnose a failure" was interpreted very broadly with respect to sufficiency of disclosure. It did not require identification of further information about the failure, such as its type. Any technical information about the other part could be the basis for the diagnosis, and it was not even important who performed the analysis. It should then also not matter which of the two parts had the failure. The technical consequence in D5 was the same as in claim 1 (prohibit jetting of hot water from the nozzle), irrespective of which part had the failure. Claim 1 also did not specify any details of the diagnosis, and the same standards should be applied to the assessment of sufficiency of disclosure and novelty.

The appellant further argued that a "failure", or the "to diagnose of a failure" as defined in Features c-bis and e, referred to a subjective human classification into "right" and "wrong" and thus represented non-technical features (statement setting out the grounds of appeal, section 1.2.4; referring to the established case law regarding mental acts and presentation of information, see Case Law, I.A.6.6.2 and 6.7). The alleged differences between claim 1 and D5, i.e. the identification of which of the controlling part and the monitoring part had a failure in the diagnosis of D5, only related to non-technical internal features ("which only existed in the software") of the non-technical act of diagnosing and represented non-technical information that had no impact on the technical consequences of Features d and f. More specifically, if jetting was prohibited irrespective of which part had the failure, as was the case both in claim 1 and in D5, the mutual diagnosis according to Features c-bis and e did not contribute to the technical consequences of Features d and f and was thus to be "ignored in assessing novelty and inventive step" (see Case Law, I.D.9.1).

2.9 These arguments are not persuasive.

Although the interpretation of the nature of the "diagnosis" borrowed from medicine leads to a broad understanding in the technical context of the patent, Features c-bis and e explicitly define a diagnosis of a failure (i.e. the recognition of the presence or absence of a failure, see point 1.3 above) "of the controlling part" and "of the monitoring part", respectively and thus, together, define a mutual, reciprocal diagnosis.

This arrangement also implies technical differences. Each of the controlling part and the monitoring part must be configured to recognise the presence or absence of a failure and to perform the shut-off function independently of the other part. Accordingly, the definition of Features c-bis to f implies a corresponding technical configuration, for example redundant control logic and signal paths, for performing the claimed mutual diagnosis and shut-off function. In contrast, D5 discloses only a single configuration in which diagnosis and shutdown are performed by a single unit. And the diagnosis of D5 does not relate to the part responsible for carrying out the diagnosis and the shut-off function but only to those parts responsible for the temperature measurement. Accordingly, Features c-bis to f define technical differences between the subject-matter of claim 1 and D5 that must be taken into account for assessing novelty and inventive step. Whether the final technical consequence is the same is not decisive. The same standard has thus been applied for sufficiency of disclosure, where all technical features of the claimed invention were considered.

It is true that computational features such as comparing and evaluating equations or conditions, apart from their technical implementation on a device, are generally considered to relate to mental and/or mathematical, non-technical features. However, as set out above, the arrangement of a mutual, reciprocal diagnosis with a corresponding shut-off function is not purely non-technical. Moreover, the term "failure" in claim 1 does not refer to a subjective, human classification into "right" and "wrong" but to the objective determination of whether the other part is functioning properly. This diagnosis involves a measurement (e.g. of the first or third signal, see paragraphs [0104] and [0105] of the patent) and is thus based on an interaction with physical reality. Such a measurement and the resulting technical information on the state of a technical device are generally considered to have technical character. This has long been accepted for a respective "presentation of information" (see Case Law, I.D.9.2.11 a)) and is, more generally, confirmed in G 1/19 (Reasons 99). Accordingly, in the current context, the configuration for diagnosing and the information determined are of a technical nature and must be taken into account in the assessment of novelty and inventive step.

2.10 Accordingly, D5 does not disclose Features c-bis to f, and the subject-matter of claim 1 is novel over D5. Therefore, the ground for opposition under Article 100(a) EPC in conjunction with Articles 52(1) and 54 EPC does not prejudice the maintenance of the patent as granted.

3. Inventive step

3.1 Starting from D5

The appellant submitted that the subject-matter of claim 1 did not involve an inventive step starting from D5 in combination with the skilled person's common general knowledge.

The appellant argued that some of the distinguishing features of claim 1 were non-technical and could not be taken into account for inventive step. This is not persuasive as set out under point 2.9 above.

In its written submissions, the appellant furthermore criticised the opposition division's reasoning regarding the effects and the objective technical problem of the distinguishing features in view of D5. According to the decision under appeal, the objective technical problem was already solved (in a different way) in D5 (section II.6.3, first sentence), which meant that the problem was incorrectly formulated. The appellant argued that without contributing to the state of the art and solving a technical problem, an inventive step was out of the question as a matter of principle.

However, the appellant itself did not put forward any effects of or a problem solved by the distinguishing features, substantiate how the characterising features of claim 1 were commonly known, or set out why the skilled person would have arrived at the subject-matter of claim 1 in an obvious manner. The Board considers that it is for an opponent (and an appellant-opponent) to set out why the subject-matter of a granted claim does not involve an inventive step.

3.1.1 The appellant's arguments are not convincing as at least the monitoring part's reciprocal diagnosis of a failure of the controlling part and its configuration to prohibit jetting or heating (Features e and f) provide an additional level of safety if the controlling part fails and thus solve the problem of further improving safety in preventing the injection of excessively heated water. In this regard, "further" refers to any improvement with respect to the safety level achieved in D5. Even if D5 itself did disclose further safety improvements in a different manner, this does not mean that the objective technical problem is completely solved in D5. Therefore, the problem of further improving safety is appropriate and does not need to be reformulated.

D5 does not contain any pointer towards a diagnosis of the controlling part. The diagnosis in D5 only concerns failures in the temperature measurement chains and does not relate to failures of the controller. Hence, even though self-diagnostic functions of controllers were part of the common general knowledge at the time of filing of the patent application (see point 1.4.4) and the skilled person could, in principle, have implemented a diagnosis of a failure of the controlling part in the "monitoring part" identified in D5, the skilled person was not made aware of the need to diagnose the controlling part and not prompted to solve the objective technical problem in this manner. Accordingly, starting from D5 in combination with the common general knowledge, the subject-matter of claim 1 involves an inventive step.

3.2 Starting from D6

3.2.1 The parties agreed that D6 discloses Features a to d but not Features e and f of claim 1 and that these distinguishing features solve the problem of further improving safety.

3.2.2 The appellant submitted that D6 already disclosed the problem that a control device of a sanitary washing device could malfunction ("in the event of a failure of a control device", paragraph [0001]; in the following, citations from the description of D6 refer to the English translation D6a) and that a "second control device" (i.e. a monitoring part), a "control circuit of a separate system", could be used for diagnosing such a failure and for initiating a safety shut-off in that event (paragraphs [0009] and [0010]).

The appellant argued that the skilled person would thus have realised that the "second control device" could also have a failure and that a further improvement of safety could be achieved by diagnosing failures of the second control device as well and carrying out the safety shut-off when the second control device (i.e. the monitoring part) failed. As there was already a "control circuit of a separate system" (microcomputer 10 representing the "controlling part") in D6, it would have been most obvious to configure the controlling part with these functions. Accordingly, the skilled person would have arrived at a reciprocal diagnosis and shut-off functionality as defined in claim 1.

Moreover, D5 also taught that a processing part of the temperature control circuit (microprocessor 8 or discrete circuitry 9) could fail and that safety could be improved by providing redundancy. The skilled person would thus have solved the objective technical problem by providing additional redundant circuitry for diagnosing failures of the "second control device" representing the monitoring part as well. As D6 already disclosed two control devices, the appellant argued that the skilled person would implement the redundancy taught in D5 in the form of reciprocity between those control devices.

Accordingly, the subject-matter of claim 1 did not involve an inventive step starting from D6 in combination with common general knowledge or D5.

3.2.3 The Board agrees that D6 discloses Features a to c as follows.

D6 concerns a sanitary washing device (Figure 3; "sanitary cleaning device", paragraph [0001]) comprising a heating part (5, Figures 2 and 5), a nozzle configured to jet water heated by the heating part toward human private parts ("cleaning the local part of the human body", see paragraph [0004]) and a controlling part (microcomputer 10, paragraphs [0006], [0021] and [0022]) configured to control at least one of the heating part (via output 10e, transistor 20 and triac 19, Figure 2) and the nozzle.

D6 further discloses that conventional sanitary washing devices (Figures 3, 4 and 6) have a water temperature detection switch 7 to shut off the water supply solenoid valve 8 as a safety feature if the water in the tank 4 becomes too hot "due to a failure of the microcomputer 10, the thermistor 6, the transistor 20 or the triac 19" (together: the "temperature control device"; paragraphs [0002] to [0008]). However, the switch does not normally shut off the supply pump 9 (see Figure 4) and the heater 5 as well, so there is still a risk that high-temperature water is jetted out of the nozzle (paragraph [0008]).

To solve this problem, D6 proposes a "second control device" (also called "control circuit of another system") to also shut off the pump motor and/or the heater when the water temperature detection switch 7 is turned off (paragraphs [0009] and [0010]). Figures 1 and 2 disclose examples of the invention. In these examples, the second control device is embodied by a relay 21 connected in parallel to the solenoid valve such that, when the valve's power supply is interrupted by the switch 7 due to a high water temperature in the tank, the pump's or heater's power supply is also interrupted. The Board agrees that the second control device or relay 21 can be considered to represent a "monitoring part" as defined in Feature c of claim 1.

3.2.4 However, the failure diagnosis of the monitoring part is not specific for a failure of the controlling part but for any failure in the temperature control chain as a whole, i.e. a failure in the temperature sensor (thermistor 6), the microcomputer 10, the transistor 20 or the triac 19 as quoted above (see also paragraphs [0019] and [0024]). Therefore, D6 does not disclose Features c-bis and d.

3.2.5 Even if it were assumed - for the sake of argument - that the relay 21 or the relay together with the switch 7 represented a monitoring part with the functionality as defined in Features c to d, i.e. a configuration to diagnose a failure of the controlling part and to prohibit heating or jetting of hot water when, specifically, the controlling part fails, the appellant's objections are still not convincing for the following reasons.

3.2.6 Although D6 uses the term "second control device", which suggests an electronic circuit, the only concrete implementation disclosed in D6 is a simple relay that applies the state of the switch 7 also to the power supply of the heater or pump. It is true that the skilled person could have used a more sophisticated circuit as the second control device, but nothing in D6 would have prompted them to do so.

The general idea in D6 (or D5) that electronic components in the temperature control system can have a failure that needs surveillance does not immediately apply to any electrical element such as the relay (or switch). It is thus questionable whether the skilled person would have derived from D6 (or D5) that the problem of further improving safety would be solved by diagnosing a failure of the relay or of the relay and the switch together.

3.2.7 Even if the skilled person had been motivated to implement a diagnosis of a failure of the second control device, irrespective of whether the second control device is in the form of a relay or an electronic circuit, the solution taught in D6 would not have led the skilled person to the claimed invention.

The solution for improving safety in the event of a failure of the (primary) control device in D6 is to apply an independent check of the water temperature in the tank downstream of the temperature control chain of the primary control device (the temperature sensor, microcomputer, transistor and triac) as a backup for prohibiting jetting hot water when the primary control device is abnormal (paragraph [0011]). In this regard, the term "downstream" also used in the decision under appeal refers to the fact that the temperature in the tank is controlled by the primary control device (via thermistor 6 and microcontroller 10), relative to which the water temperature detection switch 7 and the relay 21 define a cascaded, secondary safety mechanism that only kicks in if the temperature control by the primary control device fails.

In the alternative embodiment in which the relay turns the heater off, i.e. in which the second control device acts as a backup for the temperature control of the primary control device (Figure 2), adopting the teaching of D6 for diagnosing a failure of the second control device would mean implementing a further cascaded downstream safety mechanism, e.g. another water temperature detection switch in the tank and a third control device for shutting off the heater. In contrast, in the alternative embodiment in which the relay shuts off the pump (Figure 1), it is not even clear how the teaching of D6 could be applied for checking the second control device.

In this manner, the skilled person would arrive at a further, redundant monitoring of the water temperature but not at a reciprocal, mutual diagnosis of failures. The idea of making the diagnosis reciprocal, i.e. that the controlling part could take over the diagnosis and shut-off functionality when the second control device fails, is not obvious. Firstly, this would require a further intellectual step without any prompt as neither D6 nor D5 teaches the concept of reciprocity. Secondly, reciprocity does not fit with the "downstream" approach of D6: the second control device only kicks in when water temperature is out of the normal range, i.e. when the primary control device fails. It is thus not apparent how the microcomputer 10 (i.e. the first control device) could diagnose a failure in the second control device (e.g. that the heater still works although the water temperature in the tank exceeds the safety threshold) without itself causing a safety hazard due to an excessive water temperature in the tank, which would thus not solve the problem of further increasing safety. Thirdly, it would at least not be obvious, if possible at all, for the skilled person to implement the function of (a mechanical temperature switch and) a power relay, the only concrete examples of the "second control device" disclosed in D6, by the operation of a microcomputer.

Accordingly, the disclosure of D6 in combination with the skilled person's common general knowledge would not have led the skilled person to the subject-matter of claim 1 in an obvious manner.

3.2.8 The same applies when combining the teaching of D6 with that of D5. D5 would at best have prompted the skilled person to implement a redundant temperature measurement including separate electronic acquisition and detection circuitry upstream (e.g. parallel to the thermistor 6 in Figure 2 of D6) of the part of the microcomputer representing the "controlling part" that controls the valve, pump and heater in D6. In that way, the microcomputer would be able to diagnose whether there is a failure in one of the redundant temperature measurement chains based on a discrepancy between the measured temperature values and to prohibit heating and/or jetting. However, this would not lead to a mutual, reciprocal diagnosis between the "controlling part" and a "monitoring part", irrespective of whether a part of the temperature measurement circuitry is considered to represent the "monitoring part" as discussed under novelty and inventive step over D5 or whether the "second control device" of D6 is considered to represent the "monitoring part", and apart from the fact that neither D5 nor D6 disclose a configuration of a controlling part or a monitoring part to diagnose, specifically, the other part.

3.2.9 Therefore, the subject-matter of claim 1 involves an inventive step when starting from D6.

3.3 Consequently, the ground for opposition under Article 100(a) EPC in conjunction with Articles 52(1) and 56 EPC does not prejudice the maintenance of the patent as granted.

4. Summary

None of the grounds for opposition submitted by the appellant prejudices the maintenance of the patent as granted. The finding that the opposition is to be rejected in the decision under appeal is thus to be confirmed, and the appeal is to be dismissed.