Methods and devices for increasing the security of electronic transmission of measurement data in a sensor signal processing system

Abstract

The invention relates to the transmission of data in a sensor signal processing system, in particular from a data processing unit to a data output unit of the sensor signal processing system. If the data transmission is interrupted, there is a risk that outdated measurement data will be transmitted or that the output of measurement data will freeze. To prevent this, or at least to reduce the probability of transmitting outdated measurement data, it is proposed to monitor the transmission of write signals used to transmit the measurement data. This allows for the detection of interruptions in the measurement data flow, for example, due to spontaneous internal errors or errors in the sequence control. In this way, higher safety levels can be achieved, for example, in functional safety / functional safety applications.

Description

Field of the invention

[0001] The invention relates to devices and methods for increasing the security of electrical or electronic data transmission, in particular processed measurement data, in a sensor signal processing system. It thus contributes in particular to safeguarding safety-critical applications of such systems or to the functional safety (FuSi or FuSa for short) of sensor signal processing systems in critical environments, particularly in road or motor vehicles. State of the art

[0002] FuSi or FuSa aims at the development of secure electronic systems. This involves defining specific security levels that must be achieved and, in general, maintained. Various methods such as system analyses, risk analyses, software and hardware tests, validation, and verification are available for this purpose.

[0003] Such safety levels are represented, for example, by the ASIL (Automotive Safety Integrity Level) according to ISO standard 26262. These are different levels of vehicle safety assigned to the various systems and components of a vehicle. Each ASIL level has a different level of risk management and development process required for the development, verification, and validation of the system.

[0004] There is a trend toward ever-increasing safety requirements for electronic systems, especially for applications in vehicles. This particularly applies to sensors and the readout and analysis electronics associated with the sensors, i.e., sensor signal processing systems. Task

[0005] The object of the invention is to provide methods and devices with which the security level of an electronic sensor signal processing system can be increased. Solution

[0006] This problem is solved by the subject matter of the independent claims. Advantageous developments of the subject matter of the independent claims are characterized in the subclaims. The wording of all claims is hereby incorporated by reference into this description.

[0007] The use of the singular shall not exclude the plural, and this shall also apply in the reverse sense unless otherwise disclosed.

[0008] Individual method steps are described in more detail below. In a preferred variant of the invention, the steps are carried out in the order specified. However, the steps do not necessarily have to be carried out in the order specified, and the method to be described may also include additional, unmentioned steps.

[0009] To solve this problem, a method is proposed for increasing the security of electrical or electronic transmission of processed measurement data in a sensor signal processing system. A sensor records measurement data, and a data processing unit on an integrated circuit receives and processes the sensor's measurement data. The data processing unit transmits the processed measurement data to a data output unit of the integrated circuit, with the processed measurement data being transmitted from the data processing unit to the data output unit at a plurality of predetermined times. At the individual predetermined times, processed measurement data is transmitted, which is assigned to the individual predetermined times.

[0010] In addition, the data processing unit transmits a signal to the data output unit when the data processing unit transmits processed measurement data to the data output unit at one of the specified times. The data output unit checks whether the signal was transmitted by the data processing unit at at least one of the specified times.

[0011] If the data output unit determines that the signal was transmitted at at least one specified time, the data output unit outputs the processed measurement data at an output.

[0012] If the data output unit determines that the signal was not transmitted at at least one of the specified times, the data output unit generates an error code and / or a zero signal and outputs the error code and / or the zero signal. Preferably, the data output unit outputs the processed measurement data at the output until the data output unit generates and outputs the error code and / or the zero signal. The output of the processed measurement data is therefore only stopped when the data output unit generates and outputs the error code and / or the zero signal, thereby triggering, for example, a restart or reset of the data processing unit or the integrated circuit.

[0013] The data processing unit and the data output unit can operate synchronously with a common clock. They can also operate asynchronously with different clocks.

[0014] Particularly in FuSa projects, it is important to prevent the IC-internal or circuit-internal transmission of measurement data, i.e. sensor data and / or error codes, from a computing unit or a data processing unit to a data output unit or transmitting unit (such as a SENT interface) from being interrupted, as this could result in the indefinite transmission of outdated measurement data. Using this method, a temporary interruption in the signal flow (measurement signal, sensor signal or error code signal) caused by spontaneously occurring internal IC errors or errors in the sequence control can be detected. Sending an outdated measurement or sensor value unchanged often leads to a violation of a safety requirement. Using this method, this can be prevented or at least the probability of it occurring can be reduced, thus achieving a higher level of safety.

[0015] Using the method, the data-issuing unit can monitor whether it has received an update of the processed measurement data from the data-processing unit at at least one of the specified times. This means that the data-issuing unit can determine whether the transmission of the processed measurement data was completed as specified or whether there was an interruption in the transmission of the processed measurement data. Therefore, the method or this monitoring is preferably performed for as many of the specified times as possible, particularly preferably for all specified times.

[0016] If the data output unit detects an interruption in the transmission of the processed measurement data, it generates an error code and / or a zero signal and outputs the error code and / or the zero signal. The error code can take on different forms. For example, it can be a general error code that simply indicates that an error or malfunction is present, or it can explicitly indicate that an error occurred in the transmission. It can also be a signal to restart or reset the data processing unit and / or the integrated circuit, i.e. the data output unit triggers a restart or reset of the data processing unit and / or the integrated circuit. The error code can also include a combination of these possibilities. In many cases, the zero signal simply means that the data output unit has stopped outputting data.This can also be combined with the output of an error code.

[0017] The error code can be output to a control unit, for example. For this purpose, the output that the data output unit also uses for other outputs can be used, in particular for outputting the processed measurement data or updates to the processed measurement data that were transmitted from the data processing unit to the data output unit. However, the data output unit can also be equipped with another output that is used to transmit error codes to the control unit.

[0018] By outputting the error code and / or the zero signal, a fault or interruption in the transmission of the processed measurement data can be detected and communicated. In many cases, appropriate countermeasures can also be taken, such as a restart or reset, e.g., initiated by the control unit. The transmission of the processed measurement data can be secured in this way and restarted in the event of an interruption. This can prevent, for example, a "freeze" of the output signal.

[0019] In many cases, the transmission of processed measurement data from a data processing unit of an integrated circuit to a data output unit of the same integrated circuit is not monitored. Ultimately, an interruption or failure in the transmission often results from an internal error in the integrated circuit or physical damage to the bus or data lines used for transmission. Both of these can be ruled out in many cases or considered an entirely acceptable residual risk. However, for applications with high safety requirements, these errors or error sources can also be relevant or of interest. The proposed method makes it possible to detect these errors and respond to them appropriately.

[0020] The sensor can be, for example, a temperature or pressure sensor. It can also be designed as a magnetic field, light, motion, position, acceleration or gas sensor, in particular in the form of a Hall sensor, tachometer or induction sensor. It can be part of the integrated circuit. It can also be designed as an external sensor that is not part of the integrated circuit. To transmit measurement data, the sensor can be connected directly to the data processing unit of the integrated circuit, i.e. the connection is established solely using signal lines. However, it can also be connected indirectly to the data processing unit, e.g. via additional units such as, in particular, an analog-to-digital converter and a corresponding number of data lines.

[0021] In many cases, the sensor records measurement data distributed over time in the form of individual measured values. The measured values ​​can be digitized by the data processing unit, for example, converted into a specific format, and / or converted or transformed if necessary. The data processing unit then transmits the processed measurement data, i.e. the processed measured values, to the data output unit in the form of updates. The updates consist, for example, of the most recently measured value transmitted by the sensor. However, the sensor can also be more complex and, for example, deliver multiple measured values ​​simultaneously. Likewise, the processed measurement data can contain multiple measured values ​​and possibly even additional information, such as a checksum.The latter can also be used to secure the transmission of measurement data from the data processing unit to the data outputting unit and / or to check the correct operation of the data processing unit.

[0022] The proposed method can in particular be implemented on a computer, integrated circuit or the like.

[0023] As part of the method, it can be stipulated that the data outputting unit, once it has output an error code, continues to output the error code even if it detects that the signal was transmitted at least at a later, specified time. This clearly signals that an error has occurred. The possible later resumption of data transmission and the signal does not change the fact that there was an interruption or error in the data transmission in the meantime. In applications with high safety standards, the signaling of a one-off error, for example, can take priority over the resumption of transmission of the sensor measurement data. Only a successful restart or reset then causes the data outputting unit to stop outputting the error code or the zero signal and to output data again as intended. Such a reset can, for example,triggered by an external controller that is independent of the sensor signal processing system but is configured to receive the error code and / or the zero signal and process it accordingly. Preferably, however, the error code and / or the zero signal triggers a restart or reset of the data processing unit or the integrated circuit.

[0024] In order to fully exploit the error sensitivity of the method, the data output unit can generate and output the error code and / or the zero signal if the data output unit detects that the signal was not transmitted at just one of the specified times.

[0025] In many cases, however, it can be advantageous to implement the method with a certain degree of error tolerance. Accordingly, the data output unit only generates and outputs the error code and / or the zero signal when the data output unit determines that the signal has not been transmitted at at least a predefined number N of the specified times, where N is greater than or equal to 2. This predefined number N can be, for example, two, three, four, six, or eight.

[0026] Error tolerance can be further increased if the data output unit only generates and outputs the error code and / or the zero signal after the data output unit determines that the signal has not been transmitted for at least the predefined number N of consecutive times. Thus, only consecutive transmission errors are counted, not temporally distributed ones.

[0027] Similarly, fault tolerance can be increased using a predefined time interval, where the predefined time interval encompasses a plurality of the predefined time points. If the data output unit determines that the signal has not been transmitted once over the predefined time interval, the data output unit generates and outputs the error code and / or the zero signal.

[0028] The data-issuing unit's check to determine whether the signal was transmitted by the data-processing unit may include not only determining that a signal was transmitted, but also checking whether the signal was transmitted correctly. For this purpose, a format or protocol can be specified for the signal. If the data-issuing unit receives a signal that does not conform to this format or protocol, the data-issuing unit also determines that the signal was not transmitted at at least one of the specified times.

[0029] The format can, for example, include an address specification configured to refer to a memory, a memory area, and / or a register of the data-outputting unit in which the processed measurement data is stored. If the specification contains, for example, an invalid address—i.e., an address that cannot be assigned to a memory, memory area, or register by the data-outputting unit, or is not intended for the purpose of storing the processed measurement data—the data-outputting unit determines that the format is invalid and, therefore, the associated processed measurement data was not transmitted.

[0030] The problem is also solved by a data output unit for an integrated circuit which is adapted to carry out the steps of one of the proposed methods.

[0031] Furthermore, the object is achieved by an integrated circuit with a data output unit adapted to carry out the steps of one of the proposed methods.

[0032] Furthermore, the object is achieved if one of the methods just described, one of the data output units just described and / or one of the integrated circuits just described is used in a vehicle.

[0033] A solution to the problem also consists in a computer program comprising instructions which cause one of the data output units just described and / or one of the integrated circuits just described to carry out the steps of one of the methods just described.

[0034] A computer-readable medium on which the computer program just described is stored also represents a solution to the problem.

[0035] Further details and features will become apparent from the following description of preferred embodiments in conjunction with the figures. The respective features can be implemented individually or in combination with one another. The possibilities for achieving the object are not limited to the embodiments.

[0036] The exemplary embodiments are illustrated schematically in the figures. Identical reference numerals in the individual figures denote identical or functionally equivalent elements, or elements that correspond to one another in terms of their functions. In detail: Fig. 1 an integrated circuit connected to a sensor and having a data processing unit and a data output unit; Fig. 2 a more detailed representation of the data output unit of the Fig. 1 shown integrated circuit; and Fig. 3 a flowchart of one of the proposed procedures.

[0037] Fig. Figure 1 shows a sensor signal processing system 100 with an integrated circuit 105 for monitoring a parameter in a vehicle. The integrated circuit 105 of the sensor signal processing system 100 is connected to a sensor 110. The sensor 110 is connected to the integrated circuit 100 via signal lines 112 and 114.

[0038] During (normal) operation, the sensor 110 records analog measurement data for monitoring the parameter in the vehicle and sends the recorded analog measurement data via the signal lines 112 and 114 to an analog-to-digital converter 120 of the integrated circuit 105.

[0039] The analog-to-digital converter 120 receives the analog measurement data and converts it into digital measurement data. The digital measurement data is transmitted from the analog-to-digital converter 120 via a data line 122 to a data processing unit A of the integrated circuit 105.

[0040] The data processing unit A of the integrated circuit 105 processes the measurement data it has received via the data line 122. The data processing unit A then transmits the measurement data it has processed at predetermined times via a bus system 130, 140, 150 to a data output unit B. For this purpose, it additionally generates write signals and memory addresses.

[0041] The bus system comprises a write-enable bus 130, an address bus 140, and a data bus 150. The measurement data processed by the data processing unit A is transferred to the data output unit B via the data bus 150. The addresses of the memories within the data output unit B, in which the processed measurement data are stored, are transferred via the address bus 140. The write signals are transferred via the write-enable bus 130.

[0042] The data output unit B receives the write signals via the write-enable bus 130 and stores the processed measurement data, which is transmitted from the data processing unit A via the data bus 150, at the memory addresses transmitted via the address bus 140. It outputs the received processed measurement data via a serial output 160. Typically, a protocol is defined for this purpose. In addition to the output 160, the data output unit B also has another output 170 for outputting error codes. Using these error codes and the output of the error codes via the output 170, the data output unit B can communicate a malfunction or error in the transmission of the processed measurement data.

[0043] The analog measurement data from sensor 110 is applied to analog-to-digital converter 120 in the form of an analog signal. The amplitude of the signal represents a measured value or can be uniquely assigned to a measured value. The analog signal from sensor 110 thus represents a temporal flow of measured values. Accordingly, analog-to-digital converter 120 also transmits a flow of digital measured values ​​to data processing unit A. Data processing unit A processes the flow of digital measured values ​​and converts it into a flow of processed measurement data. Data processing unit A transmits the flow of processed measured values ​​to data output unit B in the form of updates, with an update corresponding to one of the processed measured values, preferably the most recently processed measured value. Using the write signal, data processing unit A signals to data output unit B via write-enable bus 130 that it has enabled the update orwants to transmit the measured value. In this way, the data flow from the sensor 110 to the data-outputting unit B can be transmitted in discrete packets or updates. This enables, among other things, serial output of the data flow, for example, according to the Single-Edge Nibble Transmission Protocol (SENT protocol).

[0044] Fig. Figure 2 shows a more detailed representation of the data output unit B. In addition to the components already described, the data output unit B has a decoder 200. The decoder 200 receives the write signals from the data processing unit A via the write-enable bus 130 and the memory addresses via the address bus 140. The decoder 200 processes the received write signals and memory addresses and forwards the processed write signals and memory addresses via a signal line 202 to a counter 210 and to a buffer register 230.

[0045] The buffer register 230 therefore receives the processed write signals and memory addresses from the decoder 200 via the signal line 202. In addition, the buffer register 230 receives the processed measurement data from the data processing unit A via the data bus 150. The buffer register 230 receives and stores the updates of the processed measurement data that it receives from the data processing unit A via the data bus 150.

[0046] Buffer register 230 retains the currently stored update of the processed measurement data until it is prompted via signal line 202 to accept new data from data bus 150. The processed write signals that buffer register 230 receives via signal line 202 can therefore be understood as a "load" signal for buffer register 230, i.e., as a signal to accept new data from data bus 150. Buffer register 230 also makes the updates available to a transmitter unit 240 via a data line 232.

[0047] The transmitter unit 240 retrieves the stored measurement data from the buffer register 230 via the data line 232 for output via the output 160. Additionally, the transmitter unit 240 transmits transmitter signals to a multiplexer 220 via a signal line 242. The transmitter signals each indicate that the output of the measurement data stored in the buffer register 230 has been completed.

[0048] The multiplexer 220 receives the transmitter signals from the transmitter unit 240 via the signal line 242. It also receives clock signals from a clock generator 250 via a signal line 252. The multiplexer 220 is also connected to the counter 210 via a signal line 222. With the help of the multiplexer 220, the signal lines 222 and 252, and the clock generator 250, depending on the configuration, either the clock signals of the clock generator 250 (i.e., an absolute time or a system clock) or the transmitter signals of the transmitter unit 240 provided via the signal line 242 can be forwarded to the counter 210 and used by the counter 210 to count time intervals in which an update is expected.

[0049] To count the time intervals in which an update is expected, counter 210 additionally receives the processed write signals from decoder 200 via signal line 202. Counter 210 resets to zero when it receives a processed write signal via signal line 202. If it receives a clock or transmitter signal via signal line 222, counter 210 increments by one. If counter 210 detects that a maximum counter reading has been reached, it outputs an error signal via additional output 170. The error signal is only sent by counter 210 when the check has resulted in the counter being incremented N times, in particular, for example, four times. In this way, data output unit B monitors whether it has received an update of processed measurement data at the specified times.

[0050] In this embodiment, the maximum counter value is four. In other embodiments, depending on the requirements profile or ASIL level, a different value can be selected for the maximum counter value, e.g., two, three, five, six, eight, etc.

[0051] Fig. Figure 3 shows a flowchart of an embodiment of a method 300 according to the invention for increasing the security of electronic transmission of measurement data. The method 300 can be used, for example, in the sensor signal processing system 100, which is described in the Fig. 1 and Fig. 2 and described previously.

[0052] The method 300 comprises three process strands that run concurrently, i.e., parallel and independent of one another, and also at different speeds. Accordingly, the method 300 begins with three steps 310, 311, and 312. In steps 310, 311, and 312, different subareas of the sensor signal processing system 100 are initialized. In step 310, the sensor 110, the analog-to-digital converter 120, and the data processing unit A are initialized. The data output unit B is initialized in steps 311 and 312. In step 311, in particular, the decoder 200, the counter 210, and the buffer register 230 of the data output unit B are initialized, and in step 312, in particular, the transmitter unit 240 is initialized.

[0053] After initialization in step 310, the sensor 110 records analog measurement data in step 320. Furthermore, the sensor 110 transmits the recorded analog measurement data to the analog-to-digital converter 120.

[0054] In step 325, the analog measurement data recorded by sensor 110 in step 320 are digitized by analog-to-digital converter 120. Furthermore, the digitized analog measurement data are transmitted from analog-to-digital converter 120 to data processing unit A.

[0055] In step 330, the data processing unit A processes the digitized measurement data transmitted to it in step 325 from the analog-to-digital converter 120.

[0056] In step 335, data processing unit A outputs the measurement data it has processed via data bus 150 to data output unit B for output at output 160. In addition to the processed measurement data, data processing unit A outputs write signals via write-enable bus 130 and memory addresses via address bus 140 to decoder 200 of data output unit B. With the write signals and the memory addresses, data processing unit A indicates whether it is currently transmitting updated processed measurement data. The memory addresses indicate where the processed measurement data should be stored.

[0057] Steps 310 to 335 form the first process thread of method 300. After step 335, the thread continues with step 320. The output of the processed measurement data, the write signals, and the memory addresses from the data processing unit A to the data output unit B is shown with a dashed line to indicate the transfer of these data and signals from the first process thread to a second process thread.

[0058] The second process thread begins with the initialization step 311. After the initialization, the decoder 200 of the data output unit B checks in step 340 based on the write signals transmitted by the data processing unit A via the write-enable bus 130 whether the data processing unit A is currently transmitting new data.

[0059] Each time the decoder receives a corresponding write signal, it processes the write signal and the memory address it receives from data processing unit A together with the write signal in step 350. It then sends the processed write signal and the processed memory address via signal line 202 to counter 210 and buffer register 230, also as part of step 350. This resets counter 210 to zero. In addition, buffer register 230 receives new data from data bus 150, stores it at the location specified in the processed memory address, and makes it available to transmitter unit 240 for output via output 160, i.e., buffer register 230 outputs the data stored at the location specified in the processed memory address to transmitter unit 240. The second process thread then continues with step 340.

[0060] If no write signal is received from decoder 200, the data in buffer register 230 remains unchanged. The process thread also continues with step 340.

[0061] The second process thread is therefore formed by steps 340 and 350. The output of the data stored at the location specified in the processed memory address to the buffer register 230 is also shown with a dashed line to indicate the transfer of the data stored at the location specified in the processed memory address from the second process thread to a third process thread.

[0062] The third process thread begins with the initialization of the transmitter unit 240 in step 312. The transmitter unit 240 then receives the data stored in the buffer register 230 in step 360.

[0063] In step 365, the transmitter unit 240 outputs the data received from the buffer register 230 via the output 160.

[0064] In the subsequent step 370, the transmitter unit 240 generates transmitter signals with which it indicates the output of processed measurement data. The transmitter unit 240 transmits the transmitter signals to the multiplexer 220 via the signal line 242. Furthermore, in step 370, the clock generator 250 generates a clock signal, which it transmits to the multiplexer 220 via the signal line 252. In this embodiment of the method 300, the multiplexer 220 forwards the clock signal of the clock generator 250 to the counter 210 via the signal line 222 in step 370. Alternatively, in another embodiment of the method 300, the multiplexer 220 can also be configured to forward the transmitter signal of the transmitter unit 240 to the counter 210 in step 370. If the counter receives a clock or transmitter signal via signal line 242, counter 210 counts up by one in step 370.

[0065] Subsequently, in step 375, the counter 210 checks whether a predefined maximum counter reading N has been reached. In this embodiment of the method 300, the predefined maximum counter reading is four, i.e., N=4. In other embodiments, depending on the requirement profile or ASIL level, a different value can be selected for the predefined maximum counter reading, e.g., two, three, five, six, eight, etc., i.e., the values ​​2, 3, 5, 6, 8, etc. can also be selected for N.

[0066] If the counter determines in step 375 that the maximum counter reading has not been reached, the process of method 300 continues with step 360. However, if the counter determines in step 375 that the maximum counter reading has been reached, it outputs an error signal via the additional output 170 in step 380. Method 300 can be aborted at this point. However, in parallel with step 380, the method can also be continued with a restart or reset of the sensor signal processing system 100 or steps 310, 311, and 312.

[0067] The third process strand is therefore formed by steps 360 to 380.

[0068] The error signal indicates that repeated errors occurred in the transmission of updates of the processed measurement data from data processing unit A to data output unit B. This allows appropriate countermeasures, such as restarting the sensor signal processing system, to be initiated. The cause of the error(s) does not necessarily have to lie on the data processing unit A side, but can also lie on the data output unit B side. For example, there may have been a malfunction in the data output via output 160 or something similar. Glossary integrated circuit

[0069] An integrated circuit (IC) is an electronic circuit applied to a thin, usually a few square millimeters in size, plate made of semiconductor material. The usually rectangular semiconductor plates are called a chip, and especially when combined with the applied electronic circuit they are also called a microchip. This chip is usually encapsulated in a chip housing several times larger for protection and easier contacting, which contains the actual electrical connections (pins) in a manageable size for soldering. An IC typically contains a combination of numerous electrically connected electronic semiconductor components such as transistors, diodes and / or other active and passive components. Sensor signal processing system

[0070] A sensor signal processing system comprises a sensor and its associated signal processing unit. The sensor is often an analog sensor for a physical measurement variable such as temperature, acceleration, etc. Signal processing is typically performed digitally using an integrated circuit. If the sensor delivers an analog signal, it is digitized by an analog-to-digital converter before being digitally processed. Sensor signal processing integrated circuit

[0071] A sensor signal processing integrated circuit is a sensor signal processing system implemented as an integrated circuit. The integrated circuit always includes the signal processing. It can also include the sensor itself; however, the sensor can also be external to the integrated circuit. If an analog-to-digital converter is required to convert an analog sensor signal, it is typically part of the integrated circuit. Reference symbol 100 sensor signal processing system 105 integrated circuit 110 Sensor 112 Signal line 114 Signal line 120 analog-to-digital converters 122 data line 130 Write-Enable Bus 140 Address bus 150 data bus 160 Exit 170 further exit A data processing unit B data output unit 200 decoders 202 Signal line 210 counters 220 multiplexers 222 Signal line 230 buffer registers 232 Signal line 240 transmitters 242 Signal line 250 clock generators 252 Signal line 300 Procedures for increasing the security of electronic data transmission 310 Initialization 311 Initialization 312 Initialization 320 Recording of analog measurement data 325 Analog-to-digital conversion 330 Processing of measurement data in the data processing unit A 335 Transfer of the processed measurement data to the data output unit B 340 Check for new data 350 Transfer of data into the buffer register 230 and reset of the counter 210 360 Transfer of data from the buffer register 230 to the transmitter 240 365 Output of the stored data via output 160 370 Increment counter 210 375 Check whether counter reading 4 has been reached 380 Error code output cited literature cited non-patent literature

[0072] ISO standard 26262

Claims

[1] Method (300) for increasing the security of an electronic transmission of processed measurement data in a sensor signal processing system, comprising the following steps: 1.1 a sensor (110) records measurement data (320); 1.2 a data processing unit (A) on an integrated circuit (105) receives and processes (330) the measurement data of the sensor (110); 1.3 the data processing unit (A) transmits (335) the processed measurement data to a data output unit (B) of the integrated circuit (105); 1.3.1 the processed measurement data are transmitted from the data processing unit (A) to the data outputting unit (B) at a plurality of predetermined times; 1.3.1.1 whereby, at each specified time point, processed measurement data are transmitted which are assigned to each specified time point; 1.3.2 the data processing unit (A) additionally transmits a signal (130) to the data output unit (B) when the data processing unit (A) transmits processed measurement data to the data output unit (B) at one of the predetermined times; 1.4 the data output unit (B) checks (340, 375) whether the signal was transmitted by the data processing unit (A) at at least one of the predetermined times; 1.4.1 if the data output unit (B) determines (340) that the signal was transmitted at the at least one predetermined time, the data output unit (B) outputs the processed measurement data (365); 1.4.2 If the data output unit (B) determines (375) that the signal was not transmitted at at least one of the predetermined times, the data output unit (B) generates an error code (170; 380) and / or a zero signal and outputs the error code and / or the zero signal. [2] Method (300) according to the immediately preceding claim, characterized by that the data output unit (B), once it has output an error code, continues to output the error code even if it detects that the signal was transmitted at least at one later predetermined time. [3] Method (300) according to one of the preceding claims, characterized by that the data output unit (B) generates and outputs the error code and / or the zero signal if the data output unit (B) determines that the signal was not transmitted at just one of the specified times. [4] Method (300) according to one of claims 1 or 2, characterized bythat the data output unit (B) generates and outputs the error code and / or the zero signal if the data output unit (B) determines that the signal has not been transmitted at least at a predefined number N of the predetermined times, where N is greater than or equal to 2. [5] Method (300) according to the immediately preceding claim, characterized by that the data output unit (B) generates and outputs the error code and / or the zero signal if the data output unit (B) determines that the signal has not been transmitted at least at the predefined number N of consecutive times of the predetermined times. [6] Method (300) according to one of claims 1 or 2, characterized by , 6.1 that the data output unit (B) generates and outputs the error code and / or the zero signal if the data output unit (B) detects that the signal has not been transmitted for a predetermined time interval; 6.2 wherein the specified time interval comprises a plurality of the specified points in time. [7] Method (300) according to one of the preceding claims, characterized by , 7.1 that a format is specified for the signal; 7.2 that the data output unit (B) checks the format of the signal; and 7.3 that the data-issuing unit (B) determines that the signal has not been transmitted at at least one of the specified times if the signal does not have the specified format. [8] Method (300) according to the immediately preceding claim, characterized by , 8.1 that the format includes an address; 8.2 wherein the address information is designed to refer to a memory, a memory area and / or a register (230) of the data output unit (B); 8.3 wherein the processed measurement data are stored in the memory, the memory area and / or the register (230). [9] Data output unit (B) for an integrated circuit (105) adapted to carry out steps 1.4, 1.4.1 and 1.4.2 of the method (300) according to claim 1 or the steps according to any one of the preceding method claims 2 to 8 in conjunction with steps 1.4, 1.4.1 and 1.4.2 of the method (300) according to claim 1. [10] Integrated circuit (105) with a data output unit (B) according to the immediately preceding claim. [11] Use of a method (300) according to one of the preceding claims 1 to 8 and / or a data output unit (B) according to claim 9 and / or an integrated circuit (105) according to the immediately preceding claim in a vehicle. [12] Computer program comprising instructions which cause a data output unit (B) according to claim 9 and / or an integrated circuit (105) according to claim 10 to carry out the steps of a method (300) according to any one of the preceding method claims 1 to 8. [13] A computer-readable medium on which the computer program according to the immediately preceding claim is stored.

Images