Monitoring device, monitoring system, monitoring method, computer program, and computer-readable storage medium

Abstract

The invention relates to a monitoring device (2), in which a first distributed ledger dataset, which has a first measured value, and a second distributed ledger dataset, which has a second measured value which relates to the same parameter as the first measured value but is detected by a different sensor (22 to 36), are created consecutively and transmitted to a distributed ledger network (60). The first distributed ledger dataset and the second distributed ledger dataset comprise the same reference to a preceding distributed ledger dataset. A deviation between the first and the second measured value is determined when a negative validation result is received for the second distributed ledger dataset.

Description

[0001] Description

[0002] Monitoring device, monitoring system, monitoring method, computer program and computer-readable storage medium

[0003] Technical area

[0004] The present disclosure relates to a monitoring device, a monitoring system and a monitoring method for a medical device, in particular an extracorporeal blood treatment device, such as a hemodialysis device, as well as a computer program and a computer-readable storage medium.

[0005] background

[0006] For a medical device, in particular an extracorporeal blood treatment device such as a hemodialysis machine, the ISO 14971 standard “Medical devices - Application of risk management to medical devices” stipulates that manufacturers of medical devices must implement risk reduction measures.

[0007] In current medical devices, particularly blood treatment devices such as hemodialysis machines, monitoring devices are therefore installed or implemented that have a protection system in addition to a control system. The protection system operates independently of the control system to prevent patient harm due to faulty measurement by redundantly recording measured values ​​relating to the same parameter for a treatment procedure performed with the medical device. The control system and the protection system each have a separate runtime environment. This means that each of the two systems comprises a separate processor and dedicated software.To further increase the reliability of the monitoring device and thus further reduce the risk associated with the use of the medical device, the control system and the protection system are designed in a diverse manner. This means that the control system and the protection system are implemented using different components. Consequently, complex and costly development of the hardware and software of the diverse systems is required to detect a deviation between two measured values ​​for the same parameter.

[0008] State of the art

[0009] Methods and devices for storing measured values ​​for a medical device are known from the prior art. For example, EP 3 710 966 A1 discloses a method for storing and accessing medical data records stored in a blockchain. CN 1 09 758 629 A discloses a method and device for transmitting dialysis data to store it in a blockchain. WO 2020 / 165 108 A1 discloses a system for sharing dialysis services. However, no technology is known from the cited documents that avoids the complex and cost-intensive development of a monitoring device with diverse systems that can be used in a medical device.

[0010] It is therefore an object of the present disclosure to avoid this complex and cost-intensive development of a monitoring device with diverse systems. This object is achieved by a monitoring device having the features according to claim 1, a monitoring system having the features according to claim 11, a monitoring method having the features according to claim 13, a computer program having the features according to claim 14, and a computer-readable storage medium having the features according to claim 15. Advantageous embodiments are the subject of the dependent claims.

[0011] Brief description of the disclosure A monitoring device according to the disclosure, which can be used for a medical device, in particular an extracorporeal blood treatment device, such as a hemodialysis device, has means for carrying out the following steps or is configured to: Obtain a first measured value and a second measured value, wherein the first measured value and the second measured value relate to the same parameter with respect to a treatment method performed by the medical device and are acquired by different sensors, in particular synchronously (also referred to as a measured value acquisition area); Create and transmit a first distributed ledger data record that has the first measured value and a reference to a previous distributed ledger data record (also referred to as a first creation and transmission area);Creating and transmitting a second distributed ledger record that has the second measured value instead of the first measured value and the same reference to the previous distributed ledger record after a predetermined time has elapsed and / or after receiving a positive validation result for the first distributed ledger record (also referred to as the second creation and transmission range); and detecting a discrepancy between the first measured value and the second measured value upon receiving a negative validation result for the second distributed ledger record (also referred to as the detection range).

[0012] First, two measured values, ie a first and a second measured value, for the same parameter relating to a treatment method, in particular an extracorporeal blood treatment method, which is carried out by the medical device, in particular the extracorporeal blood treatment device, are obtained by the monitoring device, in particular the measured value acquisition region.

[0013] The two measured values ​​are recorded by different sensors in order to comply with the above-mentioned ISO 14971 standard. Preferably, the two sensors are diverse, i.e. the two sensors are implemented in different ways, for example by two sensors from a different series or by two sensors from different manufacturers and / or by two sensors with different measuring principles. The sensors can be connected directly to the monitoring device. Alternatively, a dedicated computing unit for recording the measured values ​​can be provided, which is communicatively connected to the monitoring device, e.g. wirelessly or wired. The computing unit for recording the measured values ​​is capable of transmitting the measured values ​​recorded by the sensors to the monitoring device.In order to convert the signals detected by the sensors into digital measured values, the monitoring device and the computing unit for detecting the measured values ​​can have one or more analog-to-digital converters.

[0014] The monitoring device, in particular the first creation and transmission area, then creates a first distributed ledger record containing the first measured value. Accordingly, the measured value is stored or present as data, also referred to as a transaction, in the first distributed ledger record. The distributed ledger record additionally contains a reference to the previous distributed ledger record as metadata. The distributed ledger record can contain further metadata, e.g., a number of the distributed ledger record, an identifier corresponding to the monitoring device and / or the medical device, a date, a time, its own checksum, and / or a nonce (number that can only be used once) value.In the event that distributed ledger data records contain a checksum as metadata, the reference to the previous distributed ledger data record preferably corresponds to the checksum of the previous distributed ledger data record. An algorithm for generating the checksum must have the property that the same content is mapped to the same checksum. The checksum can, in particular, be a cryptographic checksum, such as a hash value. The hash value is preferably calculated using a secure hash algorithm (SHA), such as SHA-256. Particularly preferably, the date and time in the metadata correspond to the date and time of acquisition of the measured value stored as data in the distributed ledger data record.

[0015] The monitoring device, in particular the first creation and transmission area, then transmits the first distributed ledger data record, in particular to a distributed ledger network to which other participants, in particular a validation device, are connected. The distributed ledger network is preferably designed as a peer-to-peer network, thus achieving a high level of reliability. Particularly preferably, the distributed ledger network is a private distributed ledger network, so that only certain participants have access to the network in order to achieve a high level of data security.

[0016] In distributed ledger technology (DLT), any number of essentially equal copies of a ledger (cash book) containing distributed ledger records are stored decentrally and independently by multiple participants. The copies of the ledger are updated independently by each participant. For a new distributed ledger record to be incorporated into the ledger, consensus on the current state of the ledger must exist among the participants connected to the distributed ledger network. This requires a consensus algorithm, described later, which depends on the type of distributed ledger.

[0017] Subsequently, a second distributed ledger record is created, containing the second measured value instead of the first measured value, in particular through the second creation and transfer area. The second distributed ledger record contains the same reference to the previous distributed ledger record. If the first distributed ledger record contains additional metadata, this is also present in the second distributed ledger record and corresponds to the metadata of the first distributed ledger record. Exceptions to this may be the checksum of the second distributed ledger record, which depends on the content of the distributed ledger record, and the nonce value for influencing the checksum.

[0018] After the second distributed ledger data record has been created, it is transmitted to the distributed ledger network, in particular via the second creation and transmission area, after a specified time has elapsed, e.g. between 100 ms and 1000 ms, since the first distributed ledger data record was transmitted. The time between the transmission of the first distributed ledger data record and the second distributed ledger data record is set such that consensus on the first distributed ledger data record has already been reached and is consequently stored in the ledger. When setting the time, network latency and a duration for determining a validation result for the first distributed ledger data record can be taken into account, for example. Alternatively or additionally, it is also possible to wait for receipt of a positive validation result for the first distributed ledger data record.The positive validation result indicates that the first distributed ledger record is already stored in the ledger.

[0019] The transmission of the second distributed ledger record, which has the second measured value instead of the first measured value and the same reference to the previous distributed ledger record, thus represents an overwriting or modification of the first distributed ledger record in the ledger. If the second measured value deviates from the first measured value, the overwriting of the second distributed ledger record can be considered an attack or hack of the ledger. However, since numerous copies of the ledger are stored in the participants connected to the distributed ledger network, this attack will most likely be detected, and a negative validation result will be determined for the second distributed ledger record. If the second measured value corresponds to the first measured value, a positive validation result is determined.Preferably, the second distributed ledger data record can then be discarded and a positive validation result can be transmitted.

[0020] Subsequently, the validation result for the second distributed ledger data set, determined by the validation device, can be transmitted to the monitoring device. The monitoring device then receives the validation result. If a negative validation result is received for the second distributed ledger data set, the monitoring device, in particular the detection area, detects a discrepancy between the first measured value and the second measured value. Accordingly, appropriate countermeasures can be initiated upon detection of a discrepancy between the first and second measured values, thereby mitigating the risk associated with using the medical device.If no negative validation result is received or a positive validation result is received after a predetermined time, which may be set as the time for transmitting the second distributed ledger data record mentioned above, the monitoring device may determine that there is no deviation between the first and the second measured value.

[0021] The present disclosure thus provides a monitoring device in which only the sensor for detecting the first measured value and the sensor for detecting the second measured value are configured redundantly, in particular diversely. In the monitoring device according to the disclosure, detection of a deviation between the two measured values ​​is implemented exclusively by software that uses security measures of a distributed ledger technology to detect a deviation in distributed ledger data records. Consequently, development effort for diverse systems for use in a monitoring device can be avoided.

[0022] In the monitoring device according to the disclosure, the first measured value and the second measured value can be rounded to a predetermined accuracy when the first measured value and the second measured value are obtained, in particular by the measured value acquisition range. With distributed ledger technology, even a slight deviation between measured values ​​that are stored as data in different distributed ledger data sets can lead to a negative validation result. Since the measured values ​​are recorded by different sensors, which are in particular designed to be diverse, there is a high probability that the two measured values ​​differ, e.g. due to a different measurement error, at least in one decimal place. Although the measured values ​​approximately match orIf the deviation between them is within an acceptable range, a negative validation result is determined, and consequently, a deviation between the two measured values ​​is detected. Rounding the two measured values ​​to a specified accuracy can therefore prevent an unnecessary detection of a deviation between the two measured values.

[0023] The parameter for which the first and second measured values ​​are recorded can include one or more of the following parameters: conductivity, pressure, temperature, and / or flow. These parameters are particularly suitable for monitoring a treatment procedure, in particular an extracorporeal blood treatment procedure, such as a hemodialysis procedure. If a deviation is detected between two measured values ​​that affect the same of these parameters, appropriate countermeasures can be initiated to mitigate the risk associated with treatment with the medical device.

[0024] Furthermore, the monitoring device according to the disclosure can comprise means for executing a step of outputting a signal indicating the deviation between the first and second measured values ​​(also referred to as the execution range). The signal is output after the deviation has been detected by the monitoring device. Particularly preferably, the medical device has a display, such as a screen or a warning light, and / or a loudspeaker. The monitoring device is communicatively connected to the display and / or the loudspeaker or a control device thereof and can accordingly switch on the display and / or output a sound via the loudspeaker. Accordingly, medical personnel monitoring the treatment procedure performed with the medical device can be alerted to a deviation in the measured values, i.e., to an irregularity during the treatment procedure.The medical professional can then implement appropriate countermeasures, such as turning off the medical device. Consequently, the risk associated with using the medical device is further reduced.

[0025] In addition, the monitoring device can have means for executing a step for issuing a command to stop the medical device (also referred to as a further execution area). The command to stop the medical device is issued after the deviation between the first and the second measured value is detected. For this purpose, the monitoring device can be communicatively connected to a control device of the medical device, e.g. a control device of a pump, in particular a dialysis pump. Consequently, a treatment method performed with the medical device can be stopped automatically upon detection of the deviation, without the need for medical personnel to manually stop the treatment. Consequently, a risk when using the medical device can be further reduced.

[0026] Preferably, the creation and transmission of the first distributed ledger data set comprises encrypting the first measured value, in particular by the first creation and transmission area, and the creation and transmission of the second distributed ledger data set comprises encrypting the second measured value, in particular by the second creation and transmission area. The first measured value and the second measured value are encrypted in the same way, so that the encrypted measured values ​​do not differ when the same measured value is entered. Only in this way can a deviation between the first measured value and the second measured value be reliably determined. Consequently, the measured values, which represent sensitive data relating to the treatment method, can be protected from unauthorized access.It is particularly preferred that the data be digitally signed, i.e., encrypted using asymmetric cryptographic encryption. With a digital signature, the measured value is encrypted with a private key, and a public key can be used to verify the origin of the encrypted measured value without access to the measured value.

[0027] Advantageously, the first and second measured values ​​are encrypted, in particular digitally signed, corresponding to a patient and / or the monitoring device and / or the medical device. Consequently, the measured values ​​can only be decrypted and read by the patient or medical personnel treating the patient and knowing their private key. Likewise, the measured values ​​can only be decrypted and read by the operator of the monitoring device or the medical device. With a digital signature, a public key can also be used to determine the origin of the measured values. Consequently, a high level of data security can be achieved when using the monitoring device according to the disclosure. Furthermore, the first and second distributed ledger data sets can have an identifier for identifying the monitoring device and / or the medical device.As a result, it is possible to precisely determine which monitoring device or medical device obtained the measured value and created the distributed ledger dataset, so that a validation result can be transmitted preferentially to this monitoring device or medical device first to enable a timely determination of a match or discrepancy between the first and second measured values. The indicator can, for example, be determined by a public key, as described above. The participants in the distributed ledger network must know the public keys for this purpose, so that the origin of a distributed ledger dataset and the measured values ​​stored therein can be precisely determined.

[0028] According to one aspect of the disclosed monitoring device, the first and second distributed ledger data sets can be a block for a blockchain. Consequently, the ledger is a blockchain. A blockchain is a chronic sequence or chain of blocks that are linked to one another via a checksum, preferably via a cryptographic checksum, such as a hash value. The hash value is preferably calculated using a Secure Hash Algorithm (SHA), such as SHA-256. Each block stores the checksum of the previous block as a reference to the previous distributed ledger data set. If the data, i.e., the measured values, of an already validated block are changed, its checksum also changes, so that subsequent blocks become invalid.An attacker would therefore have to recalculate the checksums of all subsequent blocks. This would require a lot of computing power and would only be successful if the attacker could control 51% of the computing power in the blockchain network. An attack on a blockchain with multiple participants is therefore almost impossible and can therefore be determined and avoided. As a result, a discrepancy between the first distributed ledger data set, i.e. the first measured value, and the second distributed ledger data set, i.e. the second measured value, can be detected with a high degree of certainty using blockchain technology. In addition, multiple transactions, i.e. measured values, can be stored in a block, so that, for example, measured values ​​for multiple parameters and / or for multiple time steps can be summarized in one block.Furthermore, blockchain technology represents a distributed ledger technology that is easy to implement and manage.

[0029] According to another aspect of the present disclosure, the first and second distributed ledger records may be a node for a directed acyclic graph (DAG) and a directed graph without cycles, respectively. The nodes of the DAG are connected via edges such that no loop is formed between the nodes. The DAG may also be referred to as a tangle. Hereinafter, a distributed ledger technology that uses a DAG is referred to as DAG-DLT.

[0030] In the event that the first and second distributed ledger data sets are nodes of a DAG, the monitoring device can comprise means for performing a step of validating at least a predetermined number, in particular two or more, of previous nodes in the DAG (also referred to as a validation area). The validation step is performed before the first distributed ledger data set is created and transmitted. This can be necessary because new nodes can only be added to a DAG if two or more nodes that have not yet been validated, so-called tips, are previously validated. To do this, the monitoring device calculates a checksum of the two or more nodes that have not yet been validated and stores the checksums of the two nodes as metadata in the newly added node. The checksums can in particular be a cryptographic checksum, such as a hash value.The hash value is preferably calculated using a Secure Hash Algorithm (SHA), such as SHA-256. Unlike blockchain technology, a node in a DAG therefore contains references to multiple preceding nodes. The checksums of the multiple preceding nodes thus correspond to multiple references to previous distributed ledger records.

[0031] The newly added node is therefore a so-called tip of the DAG and must now be validated by adding a new node to the DAG. The larger the subsequent chain of nodes following a previous node, the stronger the validation and the more difficult it is for an attacker to tamper with the data stored in a previous node, as the subsequent chain of nodes must be validated again. A DAG-DLT is therefore very scalable because the number of newly added nodes increases with the number of participants. Consequently, as the number of newly added nodes increases, non-validated nodes are validated more quickly, so that manipulating the data stored in the nodes, i.e., manipulating a measured value, is only possible with great effort. Consequently, when using a DAG-DLT, a deviation between the first measured value and a second measured value can be reliably detected.

[0032] A monitoring system according to the disclosure for a medical device, in particular an extracorporeal blood treatment device, comprises: a monitoring device according to the disclosure and a validation device. The validation device has means for carrying out the following steps or is configured to: receive a distributed ledger data record containing a measured value relating to a treatment method performed by the medical device, in particular an extracorporeal blood treatment method, and a reference to a previous distributed ledger data record (also referred to as a reception area), determine a validation result for the distributed ledger data record (also referred to as a determination area), and transmit a negative validation result for the distributed ledger data record (also referred to as a transmission area).The monitoring device and the validation device are connected to one another via a distributed ledger network, which is in particular a peer-to-peer network. Of course, several monitoring devices and several validation devices can also be connected to the distributed ledger network. The distributed ledger network is preferably designed as a private network to which only certain participants have access, thus ensuring a high level of data security for the sensitive measured values ​​relating to the treatment procedure carried out with the medical device. The first and second distributed ledger data sets are therefore transmitted or broadcast by the monitoring device to a distributed ledger network, i.e., sent to all connected participants, and received there, among other things, by a validation device. The validation device then validates the distributed ledger data set, i.e.,the first or the second distributed ledger data set, and then transmits or broadcasts a validation result. The validation result is then received by the monitoring device, which can then determine that there is a discrepancy between the first and second measured values, particularly upon receipt of a negative validation result. In order to recognize that the validation result is intended for a monitoring device, the validation result can contain metadata, such as an identifier of the monitoring device or a number of the distributed ledger data set for which the validation result was determined. The monitoring system makes it possible to reliably detect a discrepancy between the first and second measured values. Consequently, the effort required to develop a monitoring device with diverse systems can be avoided.In addition, adding a new monitoring device to the monitoring system is made easy by connecting the monitoring device to the distributed ledger network.

[0033] It should be noted that a validation device and a monitoring device can also be implemented by a common computer. The computer thus functions as both a monitoring device and a validation device. However, it is also conceivable that a computer installed, for example, in the medical device could function only as the monitoring device. Consequently, less and less expensive hardware is required for the monitoring device. Furthermore, computers with high computing capacity that function exclusively as validation devices can be connected to the distributed ledger network. Furthermore, a hybrid structure is also conceivable, in which only some computers of medical devices function as validation devices and additional computers that function specifically as validation devices are present in the distributed ledger network.The validation of a distributed ledger record, and thus the selection of the validator that validates the distributed ledger record, is influenced by the consensus algorithm used. Consensus algorithms depend on the distributed ledger technology used, and different consensus algorithms can be implemented for the same distributed ledger technology.

[0034] A number of consensus algorithms have been developed for blockchain technology, which are briefly described below. It should be noted that a proprietary consensus algorithm can also be used.

[0035] The Proof-of-Work algorithm involves solving a computationally intensive mathematical problem to determine a checksum with a given property. For example, a hash value used as a checksum must begin with a certain number of zeros. Since the entire content of a block—i.e., the stored data and metadata—can be used to calculate the hash value, the block has a modifiable nonce value to influence the hash value. By changing the nonce value during validation, the hash value can be influenced to conform to the given property. Consequently, a large number of nonce values ​​must be determined during validation, and the resulting hash values ​​must be calculated. Consequently, a block in a blockchain network is validated by a validator that has high computing power and can calculate a large number of hash values ​​within a short period of time.These validation devices are called miners.

[0036] In contrast to Proof-of-Work, the Proof-of-Stake algorithm does not involve a competition to solve a mathematical problem for generating new blocks. Instead, a weighted random selection is made, with individual validators weighted according to their participation duration and / or the validations they have already performed. Alternatively, the weighting for individual validators can also be freely determined in advance. With the Proof-of-Burn algorithm, the validator must "burn" a portion of its cryptocurrency holdings in order to be allowed to validate a new block. Consequently, new blocks are primarily validated by validators who have a strong interest in reducing the cryptocurrency's supply and thus in maintaining or increasing its value.

[0037] The Proof-of-Activity algorithm is a hybrid solution combining the Proof-of-Work and Proof-of-Stake algorithms. In a first phase, the validators compete to generate the hash value that corresponds to the specified property. In a second phase, a further validator is weighted and selected to confirm the block calculated by the previous validator. Consequently, a new block will be validated in the first phase by a validator connected to the distributed ledger network that has high computing power. In a second phase, for example, a validator connected to a computer in a medical device that has been participating in the distributed ledger network for a long time can then be validated.As a result, a high level of security is achieved in the validation of blocks and thus a good detectability of the deviation between the first and second measured values.

[0038] The DAG-DLT uses a different method for validating newly added nodes. In the DAG-DLT, unvalidated nodes, i.e., tips, are validated by a participant, i.e., a supervisor, that wishes to add a new node. Consequently, in a DAG-DLT, another supervisor corresponds to the validator.

[0039] In the case where the first and second distributed ledger data sets are nodes of a DAG and the ledger is a DAG, the monitoring device can therefore comprise means for performing a step of validating at least a predetermined number, in particular two or more, of preceding nodes, i.e. tips, in the DAG (also referred to as a validation area). The validation step is performed before the first distributed ledger data set is created and transmitted. When validating the preceding nodes, their checksums are calculated and stored as references to the new block. The checksum can also correspond to a predetermined property and can therefore be influenced via a nonce value stored in each preceding node.

[0040] A monitoring method according to the disclosure for a medical device, in particular an extracorporeal blood treatment device, comprises the following steps: obtaining a first measured value and a second measured value, wherein the first measured value and the second measured value relate to the same parameter with respect to a treatment method performed by the medical device and are acquired by different sensors, in particular synchronously; creating and transmitting a first distributed ledger data record comprising the first measured value and a reference to a previous distributed ledger data record;Creating and transmitting a second distributed ledger record having the second measured value instead of the first measured value and the same reference to the previous distributed ledger record after a predetermined time has elapsed and / or after receiving a positive validation result for the first distributed ledger record; and determining a discrepancy between the first measured value and the second measured value upon receiving a negative validation result for the second distributed ledger record.

[0041] Accordingly, the first and second measured values ​​are obtained first. Then, the first distributed ledger record, which contains the first measured value and a reference to a previous distributed ledger record, is created and transmitted. After that, a second distributed ledger record, which contains the second measured value instead of the first measured value and the same reference to the previous distributed ledger record, is created and transmitted. Consequently, transmitting the second distributed ledger record constitutes an overwriting of the first distributed ledger record in the ledger and thus an attack on the ledger. The second distributed ledger record is transmitted after a predetermined time has elapsed, which is required to validate the first distributed ledger record.Alternatively or additionally, it is also possible to wait for the receipt of a positive validation result for the first distributed ledger data record. Subsequently, in the event that a negative validation result is received for the second distributed ledger data record, a discrepancy between the first measured value and the second measured value is detected. Consequently, the monitoring method according to the disclosure can reliably detect a discrepancy between the first measured value and the second measured value due to the use of distributed ledger technology that has a protection mechanism to prevent data manipulation.

[0042] The monitoring method according to the disclosure may further comprise the following steps after transmitting the first distributed ledger dataset: receiving the first distributed ledger dataset; determining a validation result for the first distributed ledger dataset; and transmitting the validation result for the first distributed ledger dataset. Consequently, the distributed ledger dataset is validated, and a positive validation result for the first distributed ledger dataset can be waited for in order to create and transmit the second distributed ledger dataset. Consequently, it is ensured that the first distributed ledger dataset is stored in the ledger and that a discrepancy between the first and second measured values ​​can be reliably detected upon transmission of the second distributed ledger dataset.Furthermore, upon receiving a negative validation result for the first distributed ledger record, it may be determined that a distributed ledger record of another monitoring device has been validated and the first distributed ledger record may be retransmitted with a new reference to a previous distributed ledger record.

[0043] Additionally, the monitoring method according to the disclosure may comprise the following steps after transmitting the second distributed ledger data set: receiving the second distributed ledger data set; determining a validation result for the second distributed ledger data set; and transmitting a validation result for the second distributed ledger data set. Accordingly, a validation result for the second distributed ledger data set is determined. Preferably, only the negative validation result can be transmitted and received to determine a discrepancy between the first and second measured values.

[0044] If the first and second distributed ledger records are nodes of a DAG, the monitoring method may include a step of validating at least a predetermined number, in particular two or more, of preceding nodes in the DAG. The validation step is performed before the first distributed ledger record is created and transmitted.

[0045] A computer program according to the disclosure comprises instructions that, when executed by a computer, cause the computer to perform the disclosed monitoring method. Consequently, the computer executing the method becomes the disclosed monitoring device. Alternatively, a system of computers executing the computer program can become the disclosed monitoring system. Consequently, a monitoring device or system is implemented that does not require expensive and complex development work for diverse systems.

[0046] Furthermore, a computer-readable storage medium according to the disclosure is provided, which stores the computer program according to the disclosure. The computer-readable storage medium is, in particular, a portable, tangible, and non-volatile storage medium that is readable by a commercially available computer, so that the method according to the disclosure is easy to implement.

[0047] The monitoring device, the monitoring system, the monitoring method, the computer program and the computer-readable storage medium according to the present disclosure thus eliminate the need for a complex and costly development of a monitoring device with diverse systems.

[0048] Brief Description of the Figures Embodiments of the disclosure are described in detail below with reference to the figures, in which like reference numerals denote like elements.

[0049] Fig. 1 schematically shows a hemodialysis device in which a monitoring device according to a first embodiment is implemented.

[0050] Fig. 2 shows a flowchart of a monitoring method according to the first embodiment of the present disclosure.

[0051] Fig. 3 shows schematically the creation of a block for a blockchain by the monitoring device.

[0052] Fig. 4 shows a schematic diagram of a blockchain.

[0053] Fig. 5 schematically shows a transmission of the distributed ledger data set in a monitoring system according to the first embodiment.

[0054] Fig. 6 shows schematically a validation of a first distributed ledger data set having a first measured value.

[0055] Fig. 7 shows schematically a transmission of a validation result in the monitoring system.

[0056] Fig. 8 shows a schematic validation of a second distributed ledger data set containing a second measured value.

[0057] Fig. 9 shows a flowchart of a monitoring method according to a second embodiment of the present disclosure.

[0058] Fig. 10 shows a monitoring device known from the prior art.

[0059] Fig. 10 shows a monitoring device U for a hemodialysis device known from the prior art. The monitoring device U is divided into a control system KS and a protection system SS. Both the control system KS and the protection system SS are connected to sensors S, which each record the same measured values ​​for parameters relating to a hemodialysis procedure performed with the hemodialysis device. The sensors S are each connected via analog-to-digital converters AD in order to convert analog measurement signals provided by the sensors S into digital measured values. The digital measured values ​​output by the analog-to-digital converters are transmitted to a processor P, in which the digital measured values ​​can be processed. The control system KS and the protection system SS each have a memory M in which the measured values ​​can be stored.The control system KS and the protection system SS are connected to each other via a communication interface K, via which a mutual transfer of the measured values ​​stored in the memory M of the control system KS and in the memory M of the protection system SS can take place. The two measured values ​​of the control system KS and the protection system SS, which are recorded by the different sensors and relate to the same parameter, are then compared in at least one of the two systems KS or SS in order to determine any deviation between the two measured values. A further risk reduction is achieved by the diverse implementation of the components, i.e. the sensors, the processors and the software running on them. The disadvantage of this is that expensive and complex development work is required for both the KS and SS systems.

[0060] The present disclosure is intended to avoid expensive and complex development work. This is achieved by implementing the checking for a discrepancy between the measured values ​​exclusively on the software side. The present disclosure uses a distributed ledger technology for this purpose. According to the disclosure, a first distributed ledger data record, which has a first measured value, and a second distributed ledger data record, which has a second measured value that concerns the same parameter as the first measured value but is recorded by a different sensor, are created one after the other and transmitted to a distributed ledger network. The first distributed ledger data record and the second distributed ledger data record have the same reference to a previous distributed ledger data record, so that the transmission of the second distributed ledger data record represents an overwriting of the first distributed ledger data record.If the second distributed ledger dataset transmitted at a later time deviates from the first distributed ledger dataset, i.e., the first and second measured values ​​differ from each other, this is detected by the distributed participants in the distributed ledger network, and a negative validation result is determined, which is transmitted to the monitoring device. Upon receipt of the negative validation result, the monitoring device is able to detect a discrepancy between the first and second measured values. Description of embodiments.

[0061] First embodiment

[0062] Fig. 1 schematically shows a hemodialysis device 1, which is an example of a medical device and in which a monitoring device 2 according to a first embodiment of the present disclosure is implemented. In addition, the hemodialysis device 1 comprises a pump control device 4 for controlling a dialysis pump (not shown), a display control device 6 for controlling an output on a display (not shown), such as a screen and / or a warning light, a speaker control device 8 for controlling sound output through a speaker (not shown), and an input control device 10 for receiving an input input through an input device (not shown), such as a keyboard, a touchscreen, and a card reader.The monitoring device 2, the pump control device 4, the display control device 6, the speaker control device 8, and the input control device 10 are communicatively connected to one another and can exchange signals with one another. Alternatively, the devices 2 to 10 can also be implemented jointly, e.g., by a single computer.

[0063] The monitoring device 2 is implemented by a computer having a processor 12, such as a central processing unit (CPU), in particular an FPGA, a memory 14, which may be a combination of RAM and ROM, an input interface 16 having a plurality of analog-to-digital converters 18, and a communication interface 20, in particular a network interface, which may be wireless or wired.

[0064] The input interface 18 is connected to a plurality of sensors 22 to 36 of the hemodialysis device 1. The sensors 22 to 36 provide analog measurement signals, which are converted into digital measurement values ​​by the analog-to-digital converter 18. Since the digital measurement values ​​correspond to the analog measurement signals, it can be simplified below that the measurement values ​​are acquired by the sensors 22 to 36. Alternatively, the sensors 22 to 36 can be connected to a computing unit for acquiring the measurement values ​​(not shown), and the monitoring device 2 can obtain the measurement values ​​via a communicative connection with the computing unit.

[0065] Sensors 22 to 28 and sensors 30 to 36 of hemodialysis device 1 each synchronously acquire measured values ​​for the same parameters related to the hemodialysis process. Accordingly, hemodialysis device 1 comprises two conductivity sensors 22 and 30, two pressure sensors 24 and 32, two temperature sensors 26 and 34, and two flow sensors 28 and 36. Sensors 22 to 36 are preferably each designed to be diverse. For example, conductivity sensors 22 and 30 may differ in their measuring principle and / or originate from a different series or from a different manufacturer. This further improves reliability and ensures reliable acquisition of measured values.

[0066] The monitoring device 2 obtains the measured values ​​for the individual parameters, i.e., conductivity, pressure, temperature, and flow, and compares them with predetermined thresholds that define a permissible range for the respective parameters. In the event that a measured value falls outside the permissible range, i.e., falls below or exceeds predetermined thresholds, the monitoring device 2 can take appropriate measures. For example, the monitoring device 2 can output a signal to stop the dialysis pump to the pump control device 4. Alternatively or additionally, the monitoring device 2 can output a signal to the display control device 6 and / or the loudspeaker control device 8 to output a warning display or a warning tone.

[0067] The input control device 10 receives input data entered via the input device. For example, the limit values ​​for the parameters relating to the hemodialysis procedure, patient data, a start and end time, and other treatment parameters can be entered by medical personnel. The input data is stored in the memory 14 and can be read by the processor 12. The communication interface 20 is used for wireless and / or wired communication with a blockchain network 60 (see Fig. 5), described later, which in the present embodiment is designed as a private peer-to-peer network. Accordingly, only specific participants have access to the blockchain network 60, thus preventing misuse of sensitive patient data. The monitoring device 2 transmits a block 38 via the communication interface 20, which is to be stored in a blockchain 52 (see Fig. 5). As shown in Fig.1, data, in particular a measured value from the sensors 22 to 36, can be stored in the block 38.

[0068] A computer program is stored in a non-volatile manner in the memory 14, which, when executed by the processor 12, causes the processor 12, in conjunction with other components 16, 18, 20 of the monitoring device 2, to execute a disclosed monitoring method shown in Fig. 2. Consequently, upon execution of the program stored in the memory 14, the computer becomes the monitoring device 2, and means or device functional areas for executing individual steps of a disclosed monitoring method are implemented.

[0069] In particular, by executing the computer program in the monitoring device 2, as shown in Fig. 1, a measured value acquisition area 202, a first creation and transmission area 204, a second creation and transmission area 206, and a determination area 208 are formed as device functional areas for executing the individual steps of the disclosed monitoring method. Furthermore, an execution area 210 and / or a further execution area 212 can be formed.

[0070] The individual steps of the monitoring method according to the disclosure are shown in the flow chart illustrated in Fig. 2 and are described below. First, in step S100, a first measured value, for example from the conductivity sensor 22, and a second measured value, for example from the conductivity sensor 30, are obtained by the measured value acquisition area 202. Consequently, the first measured value and the second measured value relate to the same parameter, but are recorded synchronously by different sensors 22 and 30, respectively. It should be noted that the first measured value and the second measured value can also be understood as multiple measured values ​​from multiple sensors 22 to 28 and 30 to 36, respectively. However, for the sake of simplicity, only one measured value is referred to below. Furthermore, it is assumed for the sake of simplicity that the first measured value is recorded by the sensors 22 to 28 and the second measured value is recorded by the sensors 30 to 36.However, it is also conceivable that the first measured value is detected by sensors 30 to 36, or that the first measured value and the second measured value are detected alternately by sensors 22 to 28 or sensors 30 to 36. In step S100, in the present embodiment, the first measured value and the second measured value are additionally rounded to a predetermined accuracy in order to avoid a slight deviation between the measured values ​​due to a different measurement error of sensors 22 to 36 or another external influence that leads to an unnecessary determination of the deviation between the first and second measured values.

[0071] Subsequently, in step S102, as shown in Fig. 3, a first block 40 containing the first measured value is created by the first creation and transmission area 204 and transmitted therefrom to the blockchain network 60. The processor 12 obtains, for example, the first measured value, which is formed from a measured value for a first parameter Par. 1 and a measured value for a second parameter Par. 2, from the memory 14. In addition, the processor 12 obtains metadata, such as a serial number of the monitoring device 2 or the hemodialysis device 1, a date, and a time, in order to store them in the first block 40. It should be noted that the serial number corresponds to an identifier of the monitoring device 2 or the hemodialysis device 1. After obtaining the first measured value from the memory 14, it is encrypted. Particularly preferably, the first measured value is digitally signed corresponding to a patient.For this purpose, the patient can enter a private key, e.g., in the form of a signature card, into the card reader of the monitoring device 2. Consequently, the encrypted first measured value can only be decrypted and read by entering the private key. Furthermore, with a digital signature, a public key is provided, which allows the origin of the encrypted first measured value. However, the public key cannot be used to decrypt the encrypted first measured value. In Fig. 3, the encryption of the first measured value is indicated by a key symbol.

[0072] The first block 40 itself also has a block number 42, which indicates a sequence in the blockchain 52, a nonce value 44, data 46, i.e., the encrypted first measured value, a hash value 48 of a previous block, and its own hash value 50. It should be noted that the fields for the block number, the date, and the time are not shown in Fig. 3 due to a simplified representation. Furthermore, it should be noted that the encryption of the first measured value is optional and therefore, in the following, the first measured value also corresponds to the encrypted first measured value.

[0073] Fig. 4 shows the blockchain 52 to which the first block 40 is to be added, as indicated by the dashed border. The blockchain 52 is a chronic sequence of blocks 54, 56, which are linked to one another via hash values. The blockchain 52 shown in Fig. 4 already has blocks 54 and 56. Block 54 is the genesis block of the blockchain 52 and thus has 0 as the hash value 48 of the previous block. The second block 56 has the hash value 50 of block 54 as the hash value 48 of the previous block. Consequently, the first block 40, which has the first measured value and is to be newly added, has the hash value 50 of block 56 as the hash value 48 of the previous block. The hash value 48 of the previous block thus corresponds to the reference to a previous distributed ledger data record.

[0074] Fig. 5 schematically shows a transmission of the first block 40 in a monitoring system 58 according to the disclosure, which in the present embodiment is formed by a plurality of hemodialysis devices 1 that are connected to one another via the blockchain network 60. The monitoring device 2 sends the first block 40 to a validation device 62 implemented in the hemodialysis devices 1 in order to validate the first block 40. The validation device 62 is preferably implemented in the computer that also implements the monitoring device 2. The validation device 62 is also implemented by the processor 12 reading and executing a computer program stored in a non-volatile manner in the memory 14, which contains instructions for causing the computer to function as a validation device 62.However, the validation device 62 can also be implemented by a standalone computer in the hemodialysis device 1 or by a dedicated computer connected to the blockchain network 60 exclusively for validation. The transmission device 2 transmits the first block 40 to all validation devices 62, i.e., the first block 40 is broadcast to all validation devices 62 for validation purposes.

[0075] In particular, by executing the computer program in the validation device 62, as shown in Fig. 5 for one of the validation devices 62, a reception area 6202, a destination area 6204 and a transmission area 6206 are formed as device functional areas.

[0076] In S104, the first block 62 is received by the receiving area 6202 of the validation devices 62 that are connected to the blockchain network 60 and in operation.

[0077] Subsequently, in S106, a validation result for the first block 40 is determined by the determination area 6204. The determination of the validation result is necessary because the first block 50 can only be appended to the blockchain 52 if there is consensus on the current state of the blockchain 52 between participants of the blockchain network 60. For this purpose, the calculation of the hash value 50 described above is performed. For blockchain technology, SHA-256 is preferably used to calculate the hash value 50. SHA-256 maps input data of any length to a hash value of constant length. Furthermore, entering the same input data in SHA-256 always results in the same hash value. In the present embodiment, the data stored in the first block 40, i.e., the first measured value, the metadata, i.e., block number, etc., and the nonce value are taken into account when calculating the hash value.

[0078] Which validator 62 in the blockchain network 60 determines the validation result is determined by a predetermined consensus algorithm. In the present embodiment, the Proof-of-Work algorithm is described as an example. In the Proof-of-Work algorithm, the difficulty of calculating the hash value 50 of a block is artificially increased by requiring the hash value 50 to correspond to a predetermined property. In the blockchain 52 shown in Fig. 4, for example, it is specified that the hash value 50 must begin with four zeros. Consequently, a large number of hash value calculations are required to validate a block. With Proof-of-Work, the validators 62 in the blockchain network 60 compete against each other, and a block is validated with a high probability by the validator 62 that has the highest computing power. Of course, other consensus algorithms, e.g.Proof-of-Stake, Proof-of-Burn oder Proof-of-Activity, verwendet werden.

[0079] A validation of the first block 40 is shown in Fig. 6. When calculating the hash value 50 of the first block 40, its entire content, i.e., the first measured value and the metadata, is taken into account, and the first block 40 has the nonce value 42, which can be changed by the validation device 62, in order to influence the hash value 50 such that it corresponds to the predetermined property. For this purpose, an initial nonce value 44 is first defined, and in S600 the hash value 50 of the first block 40 is calculated. In S602, it is then checked whether the calculated hash value 50 corresponds to the predetermined property. If the calculated hash value 50 does not correspond to the predetermined property (NO in S602), the nonce value 44 is changed in S604, and the hash value 50 is calculated again in S600. In S602 it is determined again whether the newly calculated hash value 50 corresponds to the specified property.This loop is repeated until a positive determination (YES in S602) is made in S602. If a positive determination is made in S602 (YES in S602), the validated first block 40 is transmitted in S606 to the monitoring device 2 that created and transmitted the first block 40 and to all other participants of the blockchain network 60. The connected participants, in particular the validation devices 62, then confirm the validated first block 40 by recalculating the hash value 50 using the nonce value 44 present in the first block 40. In the event of a confirmation, the connected participants incorporate the validated first block 40 into their local copy of the blockchain 52.

[0080] In the event that another block, which also has the same hash value 48 for the previous block as the first block 40, is already validated before the first block 40, a negative validation result is determined by the validation devices 62 in the blockchain network 60 and transmitted, among others, to the monitoring device 2 that created and transmitted the first block 40. The monitoring device 2 then changes the hash value 48 of the previous block and creates and transmits a new first block 40.

[0081] As described above, in S108, a positive validation result 64 for the first block 40 is transmitted through the transmission area 6206 to the transmission device 2. A transmission of a positive validation result 56 is shown as an example in Fig. 7. The validation device 62 that first validated the first block 40 is marked with a check mark. In the present embodiment, the block 40 has the serial number of the monitoring device 2, and the validation device 62 that validated the first block 40 first transmits the positive validation result 64 to the monitoring device 2 that transmitted the first block 40. Furthermore, the serial number is present in the positive validation result 64, so that the monitoring device 2 can recognize that the positive validation result 64 is intended for it.Only then is the positive validation result 64 transmitted to the other participants of the blockchain network 60.

[0082] In step S110, a second block 66 (see Fig. 8) having the second measured value instead of the first measured value is created by the second creation and transmission section 206. As shown in Fig. 8, the second block 66 has the same block number and hash value 48 as the previous block. However, instead of the (encrypted) first measured value, the block has the (encrypted) second measured value, as indicated by an asterisk in Fig. 8. After a predetermined time, which is set to 500 ms in the present embodiment, has elapsed after the first block 40 is transmitted, the second block 66 is broadcast by the second creation and transmission section 206 to validators 62 that are connected to the blockchain network 60 and in operation.The predetermined time is set, taking into account a network latency and a duration for the validation of the first block 40, such that the participants of the blockchain network 52 have already incorporated the first block 40 into the local copy of the blockchain 52. Alternatively or additionally, the monitoring device 2 can wait for receipt of the positive validation result 64 for the first block 40. A transmission of the second block 66 corresponds to the transmission of the first block 40 shown in Fig. 5. Since the second block 66 also has the same hash value 48 as the previous block, the transmission of the second block 66 can be understood as an overwriting of the first block 40 and thus as a targeted attack on the blockchain 52.

[0083] In step S112, the second block 66 is received by the receiving area 6202 of the validation devices 62 in the blockchain network 60.

[0084] In S114, a validation result for the second block 66 is determined by the determination area 6204. Since the transmission of the second block 66 represents an overwriting of the first block 40 or an attack on the blockchain 52, a validation method shown in Fig. 8 is executed for the second block 66. As described above, the second block 66 is transmitted to the blockchain network 60, in particular to the validation devices 62, in S800. Two different approaches can be used here. Firstly, the monitoring device 2 transmitting the second block 66 can leave the hash value 50 unchanged, as shown in Fig. 8, so that the first block 40 and the second block 66 differ only in the data stored therein.Upon receiving the second block 66, the validators 62 in the blockchain network 60 then recalculate its hash value 50, taking into account the nonce value 44 determined for the first block 40, since they have already stored the validated first block 40 with the hash value 48 of the previous block in their local copy of the blockchain 52. In S802, a determination is then made as to whether the newly calculated hash value 50 of the second block 66 differs from the hash value 50 of the first block 40. If the hash value 50 newly calculated for the second block 66 differs from the hash value 50 of the first block 40, i.e., the hash value 50 newly calculated for the second block 66 no longer corresponds to the predetermined property (NO in S802), a negative validation result is determined, indicating that the content of the second block has changed. The negative validation result is then transmitted in S804 to the transmission device 2 whose vision number isis present in the second block 66. If the hash value 50 newly calculated for the second block 66 and the hash value of the first block 40 match (YES in S802), the second block 66 is discarded in S806. Furthermore, a positive validation result can also be transmitted through the transmission area 6206 to the monitoring device 2 whose serial number is present in the second block 66. However, the transmission of the positive validation result is not mandatory, and the monitoring device 2 that transmitted the second block 66 can independently determine after a predetermined time has elapsed that a positive validation result has been determined.

[0085] Alternatively, the monitoring device 2 can already recalculate the hash value 50 of the second block 66 in S800, changing the nonce value 44. In this case, the validation devices 62 only need to compare the hash value 50 of the received second block 66 with the hash value 50 of the validated first block 40 stored in the local copy of the blockchain 52 to determine a validation result. Subsequently, S802 and S804 or S806 are executed analogously.

[0086] As described above, in S114, a validation result for the second block 66 is determined by the determination section 6204. In the case of a positive validation result (YES in S114), the monitoring process shown in Fig. 2 proceeds to S116, and the second block is discarded, and if necessary, a positive validation result is transmitted by the transmission section 6206. Note that a step for receiving a positive validation result is optional and therefore not shown in Fig. 2. Subsequently, the monitoring process is terminated. Consequently, after a predetermined time has elapsed after the transmission of the second block 66 and / or after receiving a positive validation result for the second block 66, the determination section 208 of the monitoring device 2 can determine that there is no deviation between the first and second measured values ​​and the hemodialysis process is being performed normally.

[0087] In case of a negative validation result (NO in S114), in S118, a negative validation result for the second block 66 is transmitted through the transmission section 6206 to the monitoring device 2 that transmitted the second block 66.

[0088] In step S120, the negative validation result is received by the monitoring device 2.

[0089] In step S122, the monitoring device 2 detects a deviation between the first measured value and the second measured value due to the detection section 208 receiving the negative validation result for the second block 66. In addition, further measures can be executed, such as outputting a signal to the display control device 6 and / or the loudspeaker control device 8 to output a warning indication via the display or a warning tone from the loudspeaker, by the execution section 210, and / or outputting a signal to the pump control device 4 to shut down the dialysis pump, by the further execution section 212.

[0090] Consequently, a deviation between the first measured value and the second measured value in the monitoring device 2 according to the first embodiment is implemented using a pure software solution. Furthermore, additional monitoring devices 2 can be easily added to the monitoring system 58 by connecting them to the blockchain network 60. Consequently, the monitoring device 2 and the monitoring system 58 according to the first embodiment avoid complex and costly development work for diverse systems. Second Embodiment

[0091] A second embodiment differs in the distributed ledger technology used. Instead of a blockchain 52, the second embodiment uses a distributed ledger technology with a directed acyclic graph, hereinafter referred to as DAG-DLT. An example of a DAG-DLT is IOTA.

[0092] Due to the use of DAG-DLT, validation of newly added nodes differs, and the monitoring method according to the second embodiment is described with reference to Fig. 9. The monitoring method shown in Fig. 9 differs from the monitoring method shown in Fig. 2 in that it additionally includes step S101. The other steps are performed analogously to those of the first embodiment.

[0093] Step S101 is necessary because a predetermined number of non-validated nodes, so-called tips, of the DAG must first be validated by a monitoring device 2 in order to add a new node to the DAG. The predetermined number of nodes is usually set to two. To validate the two nodes, the hash values ​​of the two nodes are calculated by the monitoring device and stored in the newly added node. The hash value is calculated using SHA-256. It can also be specified that the hash value must correspond to a predetermined property. Unlike blockchain technology, a node in a DAG therefore contains references to two previous nodes.

[0094] A first node having the first measured value thus has references to two previous nodes. Accordingly, in the second embodiment, a second node having the second measured value instead of the first measured value has the same references to the two previous nodes. Consequently, the monitoring device 2 also functions as a validation device 62 for a monitoring device 2 that has added a previous node.

[0095] The second embodiment of the present disclosure also provides the effects described above for the first embodiment. Additionally, the second embodiment of the disclosure is more scalable because the validation speed increases as the number of newly added nodes increases.

[0096] Finally, it should be noted that the present disclosure has been described for a hemodialysis device. However, the present disclosure is not limited thereto and may also be applied to other medical devices, such as a drug delivery device, such as an insulin pump or an infusion device, etc.

[0097] List of reference symbols

[0098] 1 hemodialysis device

[0099] 2 monitoring device

[0100] 4 Pump control device

[0101] 6 Display control device

[0102] 8 Loudspeaker control device

[0103] 10 Input control device

[0104] 12 processors

[0105] 14 storage

[0106] 16 Input

[0107] 18 analog-to-digital converters

[0108] 20 Communication interface

[0109] 22 Conductivity sensor

[0110] 24 pressure sensor

[0111] 26 Temperature sensor

[0112] 28 Flow sensor

[0113] 30 conductivity sensor

[0114] 32 pressure sensor

[0115] 34 Temperature sensor

[0116] 36 flow sensor

[0117] 38 Block

[0118] 40 first block

[0119] 42 Block number

[0120] 44 Nonce value

[0121] 46 data

[0122] 48 hash value

[0123] 50 hash value

[0124] 52 Blockchain

[0125] 54 Block

[0126] 56 Block

[0127] 58 Monitoring system 60 BI ockcha in -N etwork

[0128] 62 Validation device

[0129] 64 positive validation results

[0130] 66 second block

[0131] 202 Measurement acquisition range

[0132] 204 first creation and transmission area

[0133] 206 second creation and transfer area

[0134] 208 Determination area

[0135] 210 Execution area

[0136] 212 further execution area

[0137] 6202 Reception area

[0138] 6204 Destination area

[0139] 6206 transmission range

Claims

Claims 1. Monitoring device (2) for a medical device (1), in particular an extracorporeal blood treatment device, comprising the following device functional areas: a measurement acquisition area (202) designed and configured to acquire a first measurement and a second measurement, wherein the first measurement and the second measurement relate to the same parameter with respect to a treatment procedure performed by the medical device (1) and are acquired by different sensors (22 to 36); a first creation and transmission area (204) designed and configured to create and transmit a first distributed ledger data record (40) comprising the first measurement and a reference (48) to a previous distributed ledger data record;a second creation and transmission area (206) designed and configured to create and transmit a second distributed ledger data record (66) containing the second measurement instead of the first measurement and the same reference (48) to the preceding distributed ledger data record, after a predetermined time has elapsed and / or after receiving a positive validation result (64) for the first distributed ledger data record; and a detection area (208) designed and configured to detect a discrepancy between the first measurement and the second measurement upon receiving a negative validation result for the second distributed ledger data record (66).

2. Monitoring device (2) according to claim 1, wherein the measurement acquisition area (202) is configured such that the acquisition of the first measurement value and the second measurement value each includes rounding the first measurement value and the second measurement value to a predetermined accuracy.

3. Monitoring device (2) according to any one of the preceding claims 1 to 2, wherein the parameter comprises one or more of the parameters conductivity, pressure, temperature and / or flow rate.

4. Monitoring device (2) according to any one of the preceding claims 1 to 3, comprising an execution area (210) which is provided and designed to perform, after detection of the deviation, a step to output a signal indicating the deviation, in particular to an optical and / or acoustic output device of the medical device (1).

5. Monitoring device (2) according to any one of the preceding claims 1 to 4, with a further embodiment area (212) which is provided and designed to perform a step to issue a command to stop the medical device (1) after detecting the deviation.

6. Monitoring device (2) according to any one of the preceding claims 1 to 5, wherein the first creation and transmission area (204) is provided and configured such that the transmission of the first distributed ledger data record (40) includes encryption, in particular digital signing, of the first measured value, and the second creation and transmission area (206) is provided and configured such that the creation and transmission of the second distributed ledger data record (66) includes encryption, in particular digital signing, of the second measured value.

7. Monitoring device (2) according to claim 6, wherein the first and second measured values ​​are encrypted, in particular digitally signed, according to a patient and / or the monitoring device (2) and / or the medical device (1).

8. Monitoring device (2) according to any one of the preceding claims 1 to 7, wherein the first and the second distributed ledger data record (40, 66) comprise an identifier for identifying the monitoring device (2) and / or the medical device (1).

9. Monitoring device (2) according to any one of the preceding claims 1 to 8, wherein the first and the second distributed ledger record (40, 66) are a block for a blockchain (52).

10. Monitoring device (2) according to any one of claims 1 to 8, wherein the first and the second distributed ledger data set are a node for a directed acyclic graph, and the monitoring device (2) has a validation area which is provided and configured to perform a step to validate at least a predetermined number of preceding nodes in the directed acyclic graph before creating and transmitting the first distributed ledger data set.

11. Monitoring system (58) for a medical device (1), in particular an extracorporeal blood treatment device, wherein the monitoring system (58) comprises: a monitoring device (2) according to any one of the preceding claims 1 to 10, a validation device (62) comprising the following device functional areas: a receiving area (6202) which is provided and configured to receive a distributed ledger data record (40, 66) which includes a measured value relating to a treatment procedure performed by the medical device (1) and a reference (48) to a previous distributed ledger data record; a determining area (6204) which is provided and configured to determine a validation result for the distributed ledger data record (40, 66); and a transmission area (6206) which is provided and configured to transmit a validation result for the distributed ledger data record (40, 66); wherein the monitoring device (2) and the validation device (62) are interconnected via a distributed ledger network (60), which is in particular a peer-to-peer network.

12. Monitoring system (58) according to claim 11, wherein the distributed ledger data record (40, 66) has an identifier for identifying the monitoring device (2) and / or the medical device (1), and the validation device (62) transmits a negative validation result first to the monitoring device (2) and / or the medical device (1) corresponding to the identifier.

13. Monitoring procedure for a medical device (1), in particular an extracorporeal blood treatment device, wherein the monitoring procedure comprises the following steps: Obtaining a first measurement and a second measurement, wherein the first measurement and the second measurement relate to the same parameter in relation to a treatment procedure performed by the medical device and are detected by different sensors (22 to 36); Creating and transferring an initial distributed ledger record (40) containing the first measurement and a reference (48) to a previous distributed ledger record; Creating and transmitting a second distributed ledger record (66) containing the second measurement instead of the first measurement and the same reference (48) to the previous distributed ledger record, after a predetermined time has elapsed and / or after receiving a positive validation result (64) for the first distributed ledger record (40); and Determining a discrepancy between the first measurement and the second measurement upon receiving a negative validation result for the second distributed ledger data set (66).

14. Computer program comprising instructions which, when executed by a computer, cause the computer to perform the monitoring method according to claim 13.

15. Computer-readable storage medium in which the computer program according to claim 14 is stored.

Images