EP3018643A1 - Method for monitoring communication between a multitasking capable control device and a dosing device wirelessly connected to this and computer program product - Google Patents

Abstract

The invention relates to a method for monitoring the communication between a multitasking controller (10) and a dosing device (12) connected wirelessly thereto and a computer program product. An inventive method is used to monitor the communication between a multitasking electronic control device (10) and a wirelessly connected to this electronic control device (10) controlled dosing device (12) for acting on a living being, wherein the dosing device (12) can take several states and the State of the dosing device (12) can be changed by the dosing change commands transmitted from the control device (10) to the dosing device (12). This means in particular so-called "real-time control" between the control device (10) and dosing device (12), in which commands of a control device (10) within a fraction of a second or at least within a few seconds of the dosing device (12) are implemented. By dosing change commands are meant, in particular, those commands which, at a high intensity due to a multiple command or due to a single, too high dose change or intensity change (step size), can cause discomfort or a health hazard to an animal on which the dosing device acts. In accordance with a method according to the invention, a timer t 1 implemented by the control device (10), which is started by sending a dosing change command by a control device (10) and / or by a timer t 2 implemented by the dosing device (12), is included in FIG A dosing change command is started by a dosing device, a monitoring of maximum time limits t 1, max or t 2, max performed and exceeded at least such a maximum time limit t 1, max or t 2, max a non-executed change command is not executed or Undo an existing change order.

Description

The invention relates to a method for monitoring the communication between a multitasking electronic control device and a wirelessly connected to this electronic control device and controlled by this dosing device for acting on living beings, wherein the dosing device can assume several states and the state of the dosing device by the control device to the Dosing device transmitted dosing change commands can be changed. Furthermore, the invention relates to a computer program product in which a method according to the invention is implemented.

The method does not intend to monitor data security with regard to security against eavesdropping or the monitoring of data even during storage and transmission (keywords: cryptography, cyclic redundancy check [CRC method], etc.). The invention aims to increase the safety of animals using a dosing device and acting on the dosing device.

In the present case, dosing apparatuses are intended, in particular in the broader sense, to mean medical devices for acting on living beings, in particular devices for dosing medicaments on living beings, devices for dosing currents, voltages and other physical variables, in particular also of mechanical physical variables (forces, moments etc.). , of health care and medical devices in a broader sense. In this regard, reference is made in particular to devices for insulin administration, devices for electrical stimulation and to heat radiators. A dosing change command may in particular be a command to change the amount of insulin to be administered, to change a current, a voltage or a heat output to be delivered. It is irrelevant whether the dosing a continuous metering (eg 10 ml / h or 10 uA) and dosing change commands can have a direct effect or if the doser at regular or irregular intervals selectively dosages are delivered (eg every 6 hours 10 ml of a substance). It is crucial that due to dose-change commands, ie due to a change in the intensity and / or amount of a dose, a discomfort or even a health hazard of a living being can be caused.

With multitasking electronic control devices in the present case, all devices are meant that are not conventional remote controls for a particular technical device, but those that usually have their own operating system by - especially subsequent and by a user himself feasible - installation of programs (many portable Devices often referred to as "apps") are individually usable and can be connected to other devices by establishing a wireless connection, for example via Bluetooth, WLAN, etc. In particular, one-person portable control devices weighing typically less than 1 kg are meant. In most cases, the weight of these devices is less than 0.5 kg. These devices include, in particular, smartphones, electronic organizers, tablet PCs, portable media players and other portable devices. The devices must also allow installed programs to allow the use of a wireless connection made with the device to control other devices. The term control means in the present case, in particular, the sending of commands by means of a - preferably virtual - user interface. Such a user interface can be realized, in particular, via operating elements that are shown graphically on a touchscreen, the contact of which causes the sending of a dosing change command to the dosing device.

Use of the above-mentioned devices for controlling metering devices for the purpose of acting on living beings may lead to interruptions or temporary, considerable impairment in the case of wireless communication. The object of the invention is to provide a method by means of which such impairments are promptly detected and the risk is reduced that a dosing device will harm a living being due to such an impairment.

The object is achieved according to the invention with the features of the independent claims. Further practical embodiments are described in the subclaims.

An inventive method is used to monitor the communication between a multitasking electronic control device and a wireless connected to this electronic control device controlled dosing device for acting on a living being, the dosing device can take several states and the state of the dosing device by the control unit to the dosing metered dosing Change commands can be changed. This means, in particular, so-called "real-time control" between the control device and the dosing device, in which commands of a control device are implemented within fractions of a second or at least within a few seconds of the dosing device. By dosing change commands are meant, in particular, those commands which, at a high intensity due to a multiple command or due to a single excessive change in intensity (increment), may cause a discomfort or health hazard to an animal upon which the dosing device acts. In accordance with a method according to the invention, a timer t ₁ implemented by the control device, which is started by a control device when a dosing change command is sent, and / or by a dosing device implemented timer t ₂ , receives a dosing change command from a dosing device is started, a monitoring of maximum time limits t _{1, max} or t _{2, max} performed and exceeded at least one such maximum time limit t _{1, max} or t _{2, max} an unexecuted change command is not executed or reversed an already executed change order. With a method according to the invention, communication problems between the control device and the dosing device can be determined at short notice, in particular interruptions or considerable disturbances of a wireless connection, which can be caused for example by an increased distance of the control device from the dosing device or due to radio interference, or incorrect or incorrect pairing of devices of a Bluetooth or other radio connection. Once a communication problem is detected, by suppressing or undoing a dosing change command, a safety-enhancing action on the dosing device is immediately performed to counteract dysfunctional dysregulation of the dosing device.

• aufgrund eines Performanceverlustes oder eine in Bezug auf die Kommunikation mit dem Dosiergerät nur noch verringerte Taskpriorität über eine verringerte, für eine sichere Steuerung der Kommunikation nicht mehr ausreichende Rechenleistung verfügt,
• das Steuerungsgerät einen vollständigen oder temporären Systemabsturz erleidet (Betriebssystem hängt, Totschleife im Programmcode etc.) und/oder
• das Steuerungsgerät hardwarebedingt über eine zu geringe Rechenleistung verfügt, um Echtzeit-Messdaten von dem Dosiergerät verarbeiten zu können.

In addition, with a method according to the invention and in particular with the aid of a timer t ₂ , it can be determined when the control device

• due to a loss of performance or in relation to the communication with the dispenser only reduced task priority on a reduced, for a secure control of the communication is no longer sufficient computing power,
• the control device suffers a complete or temporary system crash (operating system hangs, dead loop in the program code, etc.) and / or
• the control device has too little computing power due to the hardware in order to be able to process real-time measurement data from the dosing device.

The timer t ₂ has the advantage that it is implemented in the dosing device itself, ie no radio connection to the control device is required, to be able to undo an already made dose change immediately.

Particular advantages arise when for t ₁ a maximum time limit t _{1, max} and for t _{2, max} a maximum time limit t _{2, max is} fixed and the exceeding already leads to a maximum time limit t _{1, max} or t _{2, max} , that an unexecuted change command is not executed or an already executed change command is reversed. Because in this case, a communication failure with potential security risk to the animal on which the dosing device acts, both the control device and the dosing device can be detected.

1. a) Starten eines Timers t₁ mit ("Mit" soll in diesem Zusammenhang und auch im Folgenden in analogen Zusammenhängen bedeuten, dass der Timer t₁ und die Absendung des ersten Datenpakets "synchron" ablaufen. Vorzugsweise erfolgen beide Handlungen gleichzeitig; es soll jedoch auch umfasst sein, wenn solche Handlungen stets um den gleichen Zeitbetrag versetzt zueinander stattfinden) der Absendung eines von dem Steuerungsgerät zu dem Dosiergerät übermittelten ersten Datenpakets, wobei das erste Datenpaket mindestens einen Dosier-Änderungsbefehl zur Änderung der Dosis um einen Betrag x enthält,
2. b) nach Erhalt des ersten Datenpakets durch das Dosiergerät sofortige Änderung der Dosis um einen Betrag x, Absenden eines zweiten Datenpakets durch das Dosiergerät an das Steuerungsgerät und gleichzeitiges Starten eines Timers t₂, wobei das zweite Datenpaket eine Empfangsbestätigung bezüglich des Dosier-Änderungsbefehls enthält,
3. c) nach Erhalt des zweiten Datenpakets durch das Steuerungsgerät Absenden eines dritten Datenpakets durch das Steuerungsgerät an das Dosiergerät, wobei das dritte Datenpaket einen Freigabebefehl bezüglich des Dosier-Änderungsbefehls enthält,
4. d) nach Erhalt des dritten Datenpakets durch das Dosiergerät Stoppen des Timers t₂ und Absenden eines vierten Datenpakets, wobei das vierte Datenpaket eine Empfangsbestätigung bezüglich des Freigabebefehls enthält,
5. e) nach Erhalt des vierten Datenpakets durch das Steuerungsgerät Stoppen des Timers t₁,
6. f) wobei für den Timer t₁ und/oder den Timer t₂ Höchst-Zeitgrenzen t_1,max bzw. t_2,max festgelegt oder einstellbar sind, deren Überschreiten bewirkt, dass die Änderung der Dosis um den Betrag x rückgängig gemacht wird.

In a practical embodiment of a method according to the invention for monitoring the communication between a multitasking electronic control device and a controlled dosing device wirelessly connected to this electronic control device for acting on a living being, the following method steps are carried out:

1. a) Starting a timer t ₁ with ("With" in this context and also in the following in analogous contexts mean that the timer t ₁ and the sending of the first data packet are "synchronous." Preferably, both actions occur simultaneously, but it should also includes, if such acts are always offset by the same amount of time) the sending of a first data packet transmitted from the control device to the dosing device, the first data packet containing at least one dosing change command for changing the dose by an amount x,
2. b) upon receipt of the first data packet by the dosing device, immediately changing the dose by an amount x, sending a second data packet through the dosing device to the control device and simultaneously starting a timer t ₂ , wherein the second data packet contains an acknowledgment regarding the dosing change command,
3. c) upon receipt of the second data packet by the control device, sending a third data packet to the dosing device by the control device, the third data packet containing a release command relating to the dosing change command,
4. d) upon receipt of the third data packet by the dosing device, stopping the timer t ₂ and sending a fourth data packet, the fourth data packet containing an acknowledgment of receipt of the release command,
5. e) upon receipt of the fourth data packet by the control device stopping the timer t ₁ ,
6. f) wherein for the timer t ₁ and / or the timer t ₂ maximum time limits t _{1, max} or t _{2, max are} set or adjustable, exceeding them causes the change in the dose by the amount x is reversed.

In this case, the dosing device can assume a plurality of states, and the state of the dosing device can be changed by dosing change commands transmitted from the control device to the dosing device. This embodiment is preferred insofar as the increased safety is not at the expense of the spontaneous response of the doser, i. Change commands from the dosing device - assuming that the communication is intact - are implemented within the same short time as in prior art connections between control devices and dosing devices, and communication checking - as well as any "correction" (= cancellation) ) of a change - occur immediately after the implementation of a change order.

In a further practical embodiment of a method according to the invention, a timer t _{3 is} started as soon as the timer t _{1 has been} stopped, and the acceptance of further dosing change commands is up to a fixed end time of the timer t _{3, end} prevented. It is irrelevant whether the timer t _{1 was} stopped because the control unit has received a fourth data packet or because the time t _{1, max was} reached and thus a "timeout" was detected. Preferably, the end time value of the timer t _{1 is transferred} to the timer t ₃ and the counter t ₁ thus continues as a counter t ₃ . Alternatively, also the timer is started t _{1 is} directly a second timer t _z are started to specify a minimum length of time from the sending of a metering change command to the sending of a next metering change command.

Analogously to the timer t ₃ described above, a timer t _{4 can be} started as soon as the timer t _{2 has been} stopped. Again, it is irrelevant whether the timer t _{2 has been} stopped because the dosing device has received a third data packet or because the time t _{2, max was} reached and thus a "timeout" was detected. Preferably, the end time value of the timer t _{2 is transferred} to the timer t ₄ and the counter t ₂ thus continues as a counter t ₄ . Alternatively, also the timer is started t ₂ directly a second timer t _z are started to specify a minimum time period of the change in a dose of up to a further change in the dose.

With the timers t ₃ , t ₄ and / or t _z described above, it is possible in particular to avoid dosing change commands which impair safety due to autorepetiating input actions which can be triggered, for example, by contamination of a touch screen, incorrect device operation, continuous key pressure, etc.

It is preferred if the maximum time limit t _{z, max} in dependence on the dosing device, a living being, on which the dosing device acts and / or is determined depending on the individual setting of the dosing device. In this regard, it is noted that in the dosing device, an amount x by which a dose can be changed is hard-coded, which can not be changed. In this case it can For example, be dependent on a parameter of a living thing, which amount x may be supplied to this creature maximally within a certain period of time, without affecting the health of the living being could be affected. For example, if the dosing device is a device for administering insulin, the maximum time limit may be determined depending on the current glucose value of a patient.

It further enhances the safety of a subject to be treated with the dosing device if the dosing device does not accept any further dosing change commands as long as a dosing change command is not implemented and the timers t ₁ and / or t _{2 are} not terminated (by "timeout" or command acknowledgment) were.

Regardless of whether the metering device allows an amount x by which the dosage of a metering unit can be changed to be changed and thus individually adjustable, it is advantageous if the metering unit accepts only metering change commands having a step size Smax and / or do not exceed a safe dose change Ds, the step size S _max and / or a safe dose change Ds being fixed in the dosing device itself. Because so can be ruled out in particular, that are added by an unintentional acceptance of multiple commands of the control device, adding, excessive amounts x as dosing change command from a controller to a dosing device. This also applies to problems caused by communication problems between the control device and the dosing device, which would lead to undesired multiple-input addition commands even though only one input command was made by a user.

In a further practical embodiment of the method according to the invention, a safe dose change Ds is determined as a function of the dosing device, the animal to be treated with the dosing device, the step size Smax set in the dosing device and a dose time ts and at least one timer ensures that the dose time is not exceeded. The method according to the invention can also be used to further increase the safety of a living being, which is to be acted upon by the control device and the dosing device, by additional time restrictions.

Between the aforementioned parameters of the (maximum) step size S _max , the dose time ts and the safe dose change Ds, the following relationship should apply: $$D_S=\frac{S_{\mathrm{Max}}}{t_S}$$

That is, the safe dose change Ds should be defined as the quotient of the (maximum) step size S _max and the dose time t _S. The dose time ts is defined as the time that has to be waited for after dispensing a dose amount, which may correspond to the set by S _max , for example, until a further dose amount (eg, S _max or alternatively a smaller dose amount) are delivered from the metering device can. In the following in connection with FIG. 1 described embodiment, the dose time is determined as the sum of t ₂ and t ₄ (t ₂ + t ₄ ). The step size Smax is a fixed, maximum amount by which the dose delivery can be changed by means of the dosing device. In a preferred embodiment, the dose amount is changeable only by the amount of the step size S _max , ie the maximum step size Smax is at the same time also the minimum step size and thus the only possible step size, ie a fixed quantum by which the dose quantity can be changed. The dimensioning of a safe dose change Ds results from a risk analysis as well as empirical values. It can also be adjusted in the course of a product's life as new insights are gained. In this regard, reference is made to the possibility of limiting the duration of operation of a dosing device on the part of the dosing device itself or indirectly via a control device in time (eg to six months) and to permit further use only if and only if an update has been carried out through an internet and / or data connection to ensure that new risk analyzes and / or findings leading to a change in the dose change Ds of the maximum increment S _max and / or the Dose ts lead to be taken into account in future applications of the dosing device. By a suitable dimensioning of the safe dose change Ds should be ensured continuously with the inventive method that a dose change by a step S _max within a safe dose time Ds no hazard and / or no discomfort caused by the dosing device living thing is caused. The safe dose change Ds must be distinguished from the permissible limits specified in standards such as DIN EN 60601. For them, a much safer value (ie a lower value for maximum limits) is always granted in order not only to comply with the existing limit values, but also to make the use of a dosing device for living organisms as pleasant as possible and, above all, safer.

The invention also relates to a computer program product with program code, with which a method as described above can be carried out. In particular, this is a computer program product that can be installed as a separate computer program in the sense of a small or very small program ("app") on a portable control device, in particular on an electronic organizer, a tablet PC, a portable media player or any other portable Device capable of establishing a wireless connection to a dosing device and controlling the dosing device via this wireless connection.

Fig. 1

zeigt ein Ablaufdiagramm eines Ausführungsbeispiels eines erfindungsgemäßen Verfahrens.

Further practical embodiments and advantages of the invention are described below in connection with FIG FIG. 1 described.

Fig. 1

shows a flowchart of an embodiment of a method according to the invention.

FIG. 1 shows a schematic representation of a control device 10 and a metering device 12 and indicated by arrows between them taking place communication.

Directs a user of the control device 10 - as indicated by the arrow 14 - a dose change, a, be the same according to the arrow 16, a timer t is started ₁ and, for example, according to the arrows 18, 20 a first data packet with a metering change command (increasing the Amperage by 10 pA) transmitted from the control unit 10 to the metering device 12.

The dosing device 12 starts after receiving the first data packet with the dosing change command according to the arrow 22, a timer t ₂ and causes according to the arrows 24, 26, a change in the dose by an amount x (eg, immediate increase in current by 10 uA). The amount x is in the in FIG. 1 shown embodiment stored in the dosing device and can be changed by a user neither on the control unit nor on the dosing device.

The dosing device 12 then sends, according to the arrow 28, a second data packet with a confirmation of the dosing change command to the control device 10.

The control unit 10 then sends according to the arrow 30, a third data packet with a release command regarding the dosing change command to the dosing device 12th

The timer t ₂ is thus stopped according to the arrows 32, 38, and the metering device 12 sends according to the arrow 34, a fourth data packet with a Acknowledgment with respect to the release command to the controller 10th

Upon receipt of the receipt confirmation with the fourth data packet, the timer t _{1 is} stopped according to the arrows 36, 40. This is regarded as a final confirmation, so that the control device 10 according to the arrows 42, 44, the resulting by changing the dose by the amount x output value (eg output value of the current increased by 10 pA).

The arrow 46 shows the case that the third data packet transmitted according to the arrow 30 has not yet arrived at the metering device 12 at a time t _{2, max} (timeout t ₂ ). In this case, according to the arrows 48, 50, the change in dose is reversed by the amount x according to the arrows 24, 26, since the timeout t ₂ indicates inadequate communication (eg, immediate reduction of current by 10μA after this was increased by 10μA shortly after receipt of the first data packet).

The arrow 52 shows the case that the fourth data packet transmitted according to the arrow 34 has not yet arrived at the control device 10 at a time t _{1, max} (timeout t ₁ ).

In this case, according to the arrows 54, 56, the change in the dose is also reversed by the amount x according to the arrows 24, 26 since the timeout t ₁ will conclude an unsafe communication.

Both in the case of a timeout t ₁ and in the case of a timeout t ₂ , an error code can be output on the control device 10.

For the two last-mentioned steps, the communication between the control unit 10 and the dosing device 12 must still be functional insofar as the control command required for the cancellation arrives at the dosing device 12 from the control device 10 or a command sent by the dosing device 12 to display an error message arrives at the control unit 10.

The arrow 58 indicates the time measurement of an optional timer t ₃ , which immediately follows the stopping of the timer t ₁ , regardless of whether it is a stop by timeout t ₁ or a stop by receipt of a fourth data packet. By means of this timer t _{3, it is} possible to set a period of time, which is to elapse, until a dosing change command is sent, by a further dosing change command indicated by the arrow 60, from the control device 10 to the dosing device by sending a time maximum value t _{3, max} 12 should be sent.

In an analogous manner, the arrow 62 indicates the timing of an optional timer t ₄ , which is immediately followed by stopping the timer t ₂ , regardless of whether it is a stop by timeout t ₂ or a stop by receiving a third data packet. By means of this timer t ₄ , a time period can be defined by a time specification of a temporal maximum value t _{4, max} , which should pass until after the change of a dose a renewed change of a dose indicated by the arrow 64 is to be accepted by the dosing device 12.

The features of the invention disclosed in the present description, in the drawings and in the claims may be essential both individually and in any desired combinations for the realization of the invention in its various embodiments. The invention is not limited to the described embodiments. It can be varied within the scope of the claims and taking into account the knowledge of the person skilled in the art.

Claims (10)

A method for monitoring communication between a multitasking electronic control device (10) and a controlled dosing device (12) wirelessly connected to said electronic control device (10) for exposure to a subject, said dosing device (12) being capable of assuming a plurality of states and the state of the dosing device (12) can be changed by dosing change commands transmitted from the control device (10) to the dosing device (12),
characterized,
in that a timer t ₁ implemented by a control device (10), which is started by a control device (10) when sending a dosing change command, and / or by a timer t ₂ implemented by a dosing device (12) receives a dosing is started -Änderungsbefehls of the dosing device (12), a monitoring time limits t _{1, max} and / or t _{2, max} performed and on exceeding at least one such time limit t _{1, max} or t _{2 max} is a non-executed metering change command is not executed or an already executed dosing change command is canceled. Method according to the preamble of claim 1, characterized by the following method steps: a) starting a timer t ₁ with the dispatch of a first data packet transmitted by the control device (10) to the dosing device (12), the first data packet containing at least one dosing change command for changing the dose by an amount x, b) after receiving the first data packet (by the metering device 12) immediate change in the dose by an amount x, sending a second data packet by the metering device (12) to the control unit and simultaneously starting a timer t _2, wherein the second data packet with respect to a receipt of the dosing change command contains c) upon receipt of the second data packet by the control device, sending a third data packet to the dosing device (12) by the control device (10), the third data packet containing a dosing change command release command; d) upon receipt of the third data packet by the dosing device (12) stopping the timer t ₂ and sending a fourth data packet, the fourth data packet containing an acknowledgment of receipt of the release command, e) after receiving the fourth data packet by the control device (10) stopping the timer t ₁ , f) wherein for the timer t ₁ and / or the timer t ₂ maximum time limits t _{1, max} or t _{2, max are} set or adjustable, exceeding them causes the change in the dose by the amount x is reversed. Method according to one or more of the preceding claims, characterized in that a timer t _{3 is} started as soon as the timer t _{1 has been} stopped and until a fixed end time of the timer t _{3, end} the sending of further dosing change commands is prevented. Method according to one or more of the preceding claims, characterized in that a timer t _{4 is} started as soon as the timer t _{2 has been} stopped and up to a fixed end time of the Timers t _4, the sending of further dosing change commands is prevented. Method according to one or more of the preceding claims, characterized in that an additional timer t _{z is} provided, which is started by sending a dosing change command or with the change of the dose and sending further dosing change commands or a further change of the dose prevented as long as a time limit t _{z, max is} not reached. Method according to the preceding claim, characterized in that the maximum time limit t _{z, max} in dependence on the dosing device (12), of the animal on which the dosing device (12) acts and / or depending on the individual setting of the dosing device (12) is determined. Method according to one or more of the preceding claims, characterized in that the dosing device (12) does not accept any further dosing change commands as long as a dosing change command has not been implemented and the timers t ₁ and / or t _{2 have been} terminated. Method according to one or more of the preceding claims, characterized in that the dosing device (12) only dosing change commands assumes that do not exceed a step size S _max and / or a safe dose change Ds, wherein the step size S _max and / or the safe dose change Ds is set in the dosing device itself. Method according to the preceding claim, characterized in that a safe dose change Ds in dependence on the dosing device (12), the to be treated with the dosing device (12) living beings, the step size S _max and a dose time ts set in the dosing device (12) is determined and it is ensured by means of at least one timer that the dose time is not exceeded. Computer program product comprising a program code for carrying out a method according to one or more of the preceding claims.

Images