fig1 shows a schematic illustration of an exemplary version of the invention . the system 10 includes a first and a second source unit 15 , a collection unit 20 , an implant 25 , and a combination unit 30 . the first and the second source unit 15 are constructed essentially identically , operate corresponding to one another , and each include a data set unit 35 , a check data unit 40 , a transmitting unit 45 , a programming device 50 , and a server 55 . the collection unit 20 includes a receiving unit 60 , a storage unit 65 , a check unit 70 , and a transmitting unit 75 . the implant 25 includes a programmable control unit 80 and a separate collection unit 20 ′, which is constructed and operates fundamentally like the foregoing collection unit 20 . the combination unit 30 includes a receiving unit 60 ′ similar to the receiving unit 60 of the collection unit 20 , a storage unit 65 ′ similar to the storage unit 65 of the collection unit 20 , a check unit 70 ′ similar to the check unit 70 of the collection unit 20 , a check data unit 40 ′ similar to the check data unit 40 of the source unit ( s ) 15 , and a transmitting unit 45 ′ similar to the transmitting unit 45 ′ of the source unit ( s ) 15 . a physician prepares control data in the form of control parameters for the implant 25 using the programming device 50 of the source unit 15 . an alternative to this preparation includes the provision of a control data set with a firmware update in the server 55 of the source unit 15 . in any case , the prepared control data are compiled by the data set unit 35 into a control data set , for which the check data unit 40 prepares a checksum as the check datum . the control data set and the check datum are sent to the collection unit 20 via the transmitting unit 45 . alternatively , the control data set and the check datum may also be sent to the collection unit 20 ′ of the implant 25 or to the combination unit 30 . the collection unit 20 receives the control data set and the check datum using the receiving unit 60 and stores the control data from the control data set in the storage unit 65 . the check unit 70 of the collection unit 25 also generates a checksum of the control data set in a way which corresponds to that of the check data unit 40 . if a comparison of the transmitted checksum to the checksum generated in the collection unit results in a correspondence , the integrity of the control data set is thus assumed . the control data are therefore transmitted to the control unit 80 of the implant 25 , where they are implemented . the combination unit 30 is designed to accept control data sets and check data from both source units 15 via the receiving unit 60 ′. the control data and / or control data sets are stored in the storage unit 65 ′, the check unit 70 ′ again generating checksums and performing a comparison . in case of a positive result , the control data sets recognized as complete and correct are combined into a joint control data set , a combination check datum for the combination control data set again being generated by the check data unit 40 ′. the combined control data set is transmitted with the combination check datum either to the collection unit 20 or directly to the implant 25 ( more precisely its collection unit 20 ′), where the combination control data set and the combination check datum are handled like a control data set and a check datum of the source unit 15 . the implant 25 is equipped with a separate collection unit 20 ′, so that it may also directly or indirectly receive control data sets and check data from a source unit 15 or a combination unit 30 and check them for integrity before they are implemented by the control unit 80 . fig2 schematically shows an exemplary sequence for preparing a control data set . in step 100 , a control datum for a setting of a first parameter is generated ( e . g ., parameter 1 → 200 ). in step 105 , a control datum for a setting of a second parameter is generated ( e . g ., parameter 2 → 50 ). in step 110 , the setting for the second parameter is overwritten ( e . g ., parameter 2 → 100 ). in step 115 , a control datum for a setting of a third parameter is generated ( e . g ., parameter 3 →“ off ”). the particular control data are introduced upon their preparation and / or revision into the control data set 200 , which then contains the control data having the desired settings . in step 120 , the termination of the settings is initiated to initiate the transmission of the control data set . in step 125 , the content of the control data set is displayed , so that the user may perform a confirmation in step 130 . in step 135 , the control data set is released for a transmission to an implant . fig3 a - 3 c show schematic sequences of an exemplary version of the invention . fig3 a shows that a control data set 200 is transmitted from a patient device 85 , tuned to the implant 25 , which serves as a relay station to the implant 25 . in the implant 25 , a checksum 205 is calculated from the control data set 200 by a correspondingly programmed cpu or computing unit 90 of the collection unit of the implant 25 . in the event of a correspondence , which is established in step 155 , the predetermined execution of all control data which were contained in the control data set 200 is performed , in step 160 . if the checksums do not correspond , all control data of the control data set 200 are discarded in step 165 . fig4 a - 4 d show schematic sequences of another exemplary version of the invention . the relay station 85 ( the patient device ) has obtained a firmware update here and transmits it in smaller packets to the implant 25 . for this purpose , the patient device 85 transmits a control data set start signal 210 to the implant 25 ( fig4 a ). it then transmits the firmware update together with further control data such as new control parameters to the implant 25 ( fig4 b , 4 c ) in packets 215 , 215 ′, whose size and number result through the communication protocol between implant 25 and patient device and the extent of the control data and / or the control data set ( of the update ). after all packets 215 , 215 ″ have been transmitted , the patient device 65 transmits a control data set end signal 225 to the implant 25 ( fig4 d ). upon receiving the control data set end signal 225 , the implant assumes that all control data of the control data set 200 have been completely received , because in the event of a communication breakdown between implant 25 and patient device 85 , the control data set end signal would not have arrived . by generating the control data set start and end signals , the patient device 85 at least partially assumes the function of a check data unit and is thus also to be seen as a component of a source unit within the meaning of the invention . upon a transmission of a program ( control data ) to an implant by remote programming , according to one exemplary version of the invention , a home monitoring service center ( hmsc ) compiles a data packet having multiple individual changes as in a “ shopping basket ” and provides the packet with a secure checksum . the implant receives the packet and checks the integrity of the packet on the basis of the checksum . if the packet is intact ( the checked checksums correspond ), the individual changes contained therein are completely executed . if the packet is incomplete or damaged ( the checksum is erroneous ), the contained changes are completely discarded , because it cannot be known which individual control data could still possibly be executed in spite of the incompleteness . a further exemplary version of the invention relates to the transmission of new firmware to the implant by remote programming . the hmsc sends new implant firmware to a patient device ( also called a telex ) tuned to the implant . the telex sends a “ transaction start ” command to the implant . the telex sends a firmware image divided into multiple individual packets to the implant . the telex sends a “ transaction end ” command to the implant . the implant checks the transmitted firmware on the basis of the checksum upon receipt of the “ transaction end ” command and activates the new firmware in the event of correctness . if the “ transaction end ” command is not received , the implant state does not change , and the received parts of the new firmware are discarded ( preferably after passage of a specific deadline ). one exemplary version of the invention relates to an alteration of the implant program using a clinical programmer . on the programming device ( programmer ), an implant parameter was altered and the program transmitted . various parameter blocks had to be altered concurrently . either all alterations are to be executed or none of them . the parameter blocks “ sensingbradycommon ” and “ bradymodepage ” were altered , which are in various positions in the implant . the command “ accept program ” is to be transmitted , which activates the changes . the command “ restart statistics ” is to be executed , because after the programming the statistics become inconsistent . the command “ detection on ” is to be transmitted . the four commands ( the alteration of the parameter blocks and the three commands ) are compiled into one block ( control data set ) and transmitted to the implant provided with a checksum . after the completed transmission of the block , the implant checks the checksum and aborts in the event of an erroneous checksum . the parameter blocks “ sensingbradycommon ” and “ bradymodepage ” are assumed at the target position in the implant . the commands “ accept program ”, “ restart statistics ”, and “ detection on ” are executed . the implant transmits a completion acknowledgment to the programming device . as an illustration of another exemplary version of the invention , upon transmission of new firmware to the implant by a clinical programmer , the control software of the implant is replaced by a newer version . in addition , the parameter settings are adapted to the new control software and also transmitted to the implant in addition to the new firmware . a firmware update lasts ( for example ) approximately 3 minutes . during the procedure , the old control software is to be active . after successful transmission , the new control software is activated together with the new parameters at one stroke . a total of ( for example ) 30 steps must be executed . all steps are transmitted by the programmer into a buffer memory of the implant . the new software and the parameter settings become active at one stroke in the implant with the last step “ copy and activate ”, if the check of the check data of the transmission of the control data set having the firmware update and the new parameter settings indicates a complete and correctly received control data set . the present invention allows the user to execute aftercare via remote programming in a familiar way . he may alter parameters , accept them in a “ shopping basket ”, alter further parameters ( e . g ., on another gui page ), also accept them in the “ shopping basket ”, set an instruction to restart the statistics in the “ shopping basket ”, and trigger a transmission of the “ shopping basket ”. the complex reprogrammings combined in the “ shopping basket ” then occur either completely or not at all . intermediate states in the implant ( half programmed , e . g ., due to connection interruption or transmission error ) are thus prevented . the transmission of a ( large and complex ) parameter set may preferably be interrupted at any time , so that emergency commands may be transmitted and executed within a short time . the described transmission method is generic . programming may include a sequence of many small blocks and commands . the composition and sequence of the programming may be performed by changes on the hmsc program ( remote programming ) without altering the implant control software .
a cardiac pacemaker , defibrillator , or other programmable medical device includes a source unit and a collection unit . the source unit has a check data unit generating at least one check datum for control data for the medical device , and a transmitting unit transmitting the control data and the check datum to the collection unit . the collection unit has a storage unit storing the control data , a check unit checking the integrity of the control data using the check datum , and a transmitting unit transmitting the control data to a programmable control unit of the medical device only if the integrity of the control data is established by the check unit . the control unit of the medical device controls the functions of the medical device on the basis of the transmitted control data .