SENSOR ARRANGEMENT FOR SAFETY-CRITICAL APPLICATIONS AND PROCEDURES FOR PROVIDING SENSOR DATA AND DIAGNOSTIC INFORMATION

Description

[0001] The invention relates to a sensor arrangement for safety-critical applications and a method for providing sensor data and diagnostic information to a data processing unit of a sensor arrangement for safety-critical applications.

[0002] For example, German patent application DE 10 2013 200330 A1 discloses a sensor arrangement for safety-critical applications according to the preamble of claim 1 and a method for providing sensor data and diagnostic information according to the preamble of claim 14. German patent application EP 2 869 147 A2 describes a similar arrangement and a similar method.

[0003] A well-known sensor arrangement for safety-critical applications or (sub-)processes includes a higher-level data processing unit or serial interface ("Serial-Peripheral Interface SPI" or client or master) that is connected to a sensor unit which includes at least two sensor channels (server or slaves) for acquiring first and second sensor data.

[0004] To ensure sufficient security, the data processing unit of the conventional sensor array retrieves the first and second sensor data from the two sensor channels of the sensor unit and compares them. This so-called client-side "cross-check" generates information indicating whether the sensor data is faulty or not, i.e., whether the sensor data meets a certain level of confidence. One disadvantage of this approach is that comparatively large amounts of data must be transmitted from the sensor unit to the data processing unit, and the data processing unit must be designed to receive and process this data.

[0005] It is therefore an object of the invention to provide a more efficient sensor arrangement for safety-critical applications and a more efficient method for providing sensor data and diagnostic information to a data processing unit of a sensor arrangement for safety-critical applications.

[0006] This problem is solved according to the invention by the features of claim 1, and in particular by the fact that the sensor arrangement for safety-critical applications comprises a data processing unit connected to a sensor unit. The sensor unit comprises at least two sensor channels for acquiring first and second sensor data and a diagnostic unit for generating diagnostic information based on the first and second sensor data. The first sensor channel of the at least two sensor channels does not include a diagnostic unit (of the type mentioned above). The second sensor channel of the at least two sensor channels comprises the diagnostic unit. The second sensor channel is configured and configured to transmit the diagnostic information to the data processing unit. The diagnostic unit of the second sensor channel is configured and configured to transmit the first sensor data and the second sensor data to the data processing unit.Additionally, the first sensor channel can also be set up and configured to transmit the first sensor data or the second sensor data to the data processing unit.

[0007] This means that the sensor data is not checked in the data processing unit, but rather in one of the sensor channels. This significantly reduces the computational load on the data processing unit and improves its response time. It also allows for less demanding hardware and / or software requirements for the data processing unit, meaning it can be simpler in design and configuration.

[0008] Furthermore, because the data processing unit receives the result of the sensor data check—i.e., the already generated diagnostic information—from the sensor unit, only one set of sensor data needs to be transmitted from the sensor unit to the data processing unit, instead of multiple sets. This, in turn, reduces the communication between the data processing unit and the sensor unit. Specifically, only one sensor channel sends only one set of sensor data to the data processing unit, and only one sensor channel sends the diagnostic data to the data processing unit. This has a positive impact on the response time, EMC performance, and power consumption of the sensor array. Additionally, less stringent requirements can be placed on the communication channel between the data processing unit and the sensor unit (e.g., a data bus).

[0009] In this context, a sensor unit is understood to be a measuring device designed to generate safety-critical application information (sensor data), such as distance information, and transmit it to the data processing unit (serial interface). A safety-critical or safety-relevant application is understood to be an application where it must be ensured with the highest possible, preferably near-absolute, certainty that the application information generated by the sensor unit is error-free.

[0010] Further embodiments are specified in the claims, the description, and the accompanying drawings. In the following, "equipped" always means "set up and equipped."

[0011] According to one embodiment, the second sensor channel is configured to transmit the first sensor data or the second sensor data and the diagnostic information to the data processing unit. This means that the sensor channel encompassing the diagnostic unit is responsible for both data comparison and the transmission of the set of sensor data and the diagnostic result to the data processing unit. As a result, the first sensor channel can be of a comparatively simple design.

[0012] According to one embodiment, the second sensor channel is configured to receive sensor data from the first sensor channel and to generate diagnostic information using the diagnostic unit based on the received sensor data and sensor data acquired by the second sensor channel (i.e., sensor data acquired independently).

[0013] According to one embodiment, the first sensor channel is configured to transmit either the first sensor data or the second sensor data and the diagnostic information to the data processing unit. This means that the sensor channel not containing the diagnostic unit can be responsible for transmitting the data to the data processing unit, while the sensor channel containing the diagnostic unit is responsible for generating the diagnostic information. This distributes the processing load more evenly across the sensor channels.

[0014] According to one embodiment, the first sensor channel is configured to transmit sensor data acquired by the first sensor channel (i.e., sensor data acquired by the first channel) to the second sensor channel and to receive sensor data acquired by the second sensor channel as well as diagnostic information generated by the diagnostic unit of the second sensor channel from the second sensor channel.

[0015] According to one embodiment, the second sensor channel is configured to transmit the first sensor data or the second sensor data to the

[0016] The first sensor channel is configured to transmit the diagnostic information to the data processing unit. This means that the sensor channel encompassing the diagnostic unit is responsible for transmitting the data to the data processing unit, while the sensor channel not encompassing the diagnostic unit is responsible for generating the diagnostic information. Accordingly, a distribution of the computational load is achieved here as well.

[0017] According to an alternative embodiment, the first sensor channel is configured to transmit the first sensor data or the second sensor data to the data processing unit, and the second sensor channel is configured to transmit the diagnostic information to the data processing unit.

[0018] In contrast to the example explained above, not only the second, but also the first sensor channel can have a diagnostic unit.

[0019] According to one embodiment, two or more of the at least two sensor channels comprise their own diagnostic unit; in particular, the first and second sensor channels each comprise a diagnostic unit configured to generate diagnostic information based on the first and second sensor data. Consequently, two or more sets of diagnostic information can be provided to the data processing unit, and the data processing unit can be configured to compare these two or more sets of diagnostic information. This further enhances process reliability.

[0020] According to one embodiment, the data processing unit and the sensor unit are separate units, meaning they are physically separated from each other. This facilitates the maintenance or replacement of the sensor unit and / or the data processing unit.

[0021] According to one embodiment, the data processing unit and the sensor unit each have their own separate housing. The generation of diagnostic information therefore takes place exclusively within the sensor unit's housing. Additionally or alternatively, the data processing unit and the sensor unit can have different circuit boards. However, it is also conceivable that the data processing unit and the sensor unit are arranged on the same circuit board, with the data processing unit comprising an SPI master chip and the sensor unit comprising a sensor chip. That is, the two chips are integrated on a common circuit board. The sensor chip can comprise two sensor channels of the type described above, with each sensor channel comprising an SPI slave and / or capable of performing its function.

[0022] According to one embodiment, the first and / or second sensor channel comprises a sensor for generating the first and / or second sensor data. For example, the first sensor channel has a first sensor for generating the first sensor data and the second sensor channel has a second sensor for generating the second sensor data.

[0023] For example, if three or more sensor channels are present, each of these three or more sensor channels can contain one or more sensors. It is also possible that one or more of the at least two sensor channels contain two or more sensors.

[0024] The sensors can be of the same or different types; that is, they can generate sensor data of the same or different types or data structures. Preferably, the first and second sensor data points indicate the same physical or chemical quantity, for example, a distance to an object or product, a temperature, or the like.

[0025] It is also possible that the first sensor channel and the second sensor channel comprise a single common sensor for generating the first and second sensor data, whereby the sensor for generating the first and second sensor data can be read out in two different ways or at least separately and twice in the same way (e.g. by different evaluation means, such as analog-to-digital converters).

[0026] According to one embodiment, the at least two sensor channels detect the same safety-critical process. The safety-critical process could be, for example, a product sorting process, in particular the sorting of packages of different sizes, a chemical process in which critical process parameters must be kept within a specific range, the control of a machine that is potentially dangerous to a person, the monitoring of a safety guard, the monitoring of a light barrier, and / or the control of two-hand switches.

[0027] According to one embodiment, the first and / or second sensor channel comprises a linear encoder and / or a rotary encoder for generating position information.

[0028] According to one embodiment, the diagnostic unit is configured to generate the diagnostic information as a binary signal or as a switching signal that, upon receipt, causes the data processing unit to change an operating state of the sensor arrangement. The binary signal indicates, for example, whether the first and second sensor readings match or not. This minimizes the amount of data that needs to be transmitted between the sensor unit and the data processing unit. Changing the operating state includes, for example, the data processing unit causing the safety-critical process to be stopped in the event of a fault. This enables a particularly rapid response to a fault condition.

[0029] According to one embodiment, the diagnostic unit is configured to generate diagnostic information by comparing the first and second sensor data. This comparison can be performed by subtracting the first sensor data from the second sensor data (or vice versa), or by another mathematical operation suitable for the sensor data. The diagnostic information, in particular the result of the cross-check, can, for example, be transmitted to the data processing unit as the difference between the first and second sensor data with a predetermined resolution.

[0030] According to one embodiment, in a case where a deviation between the first and second sensor data exceeds a predetermined threshold, the diagnostic information indicates a fault, and in a case where a deviation between the first and second sensor data does not exceed the predetermined threshold, the diagnostic information indicates that no fault is present.

[0031] According to one embodiment, the predetermined threshold is stored in a memory of the diagnostic unit. The predetermined threshold can be adapted to the safety-critical process. The predetermined threshold can also be dynamically adjusted or updated during the monitoring of the safety-critical process. In a case where several safety-critical processes are monitored simultaneously, several predetermined thresholds can be stored by the diagnostic unit or by multiple diagnostic units.

[0032] According to one embodiment, the predetermined threshold corresponds to a deviation between the first and second sensor data of 0.01% to 25%, in particular of 0.1% to 10%, and in particular of 1% to 5%.

[0033] According to one embodiment, the first and / or second sensor channel is configured to transmit the first sensor data or the second sensor data to the data processing unit in response to receiving a sensor data request from the data processing unit. This means that the first and / or second sensor channel only transmits on request, which is particularly energy-efficient.

[0034] The data processing unit can be configured to transmit the sensor data request simultaneously to the first and second sensor channels, so that the first and second sensor channels essentially acquire the first and second sensor data at the same time. The sensor channels can receive the sensor data request via the same data line. This means there is no time delay in receiving the sensor data, which reduces the deviation between the sensor data.

[0035] According to one embodiment, the first and / or second sensor channel is configured to repeatedly transmit the first sensor data or the second sensor data to the data processing unit, particularly at predetermined time intervals. This reduces the computational load on the data processing unit, as it does not need to send a request.

[0036] According to one embodiment, the data processing unit and the sensor unit and / or the at least two sensor channels are connected via a communication channel. The communication channel preferably comprises a data line. The data line can, for example, have a length of at least 1 meter, 2 meters, 4 meters, or more and be designed as a cable. The data transmitted between the diagnostic unit and the data processing unit is accordingly transmitted via the communication channel. The communication channel is, for example, a synchronous serial data bus, an HDSL line, and / or point-to-point communication.

[0037] In this context, the term HDSL stands for "HIPERFACE DSL," and the HDSL line specifically refers to a DSL-like line of the HIPERFACE system from Sick AG. The HDSL line is therefore a proper noun. The HDSL line can transmit sensor and diagnostic data, particularly using a DSL-like transmission technology with a multitude of simultaneously used carrier frequencies.

[0038] If the first and second sensor channels and the data processing unit are connected via the HDSL line, one of the at least two sensor channels can be inactive or deactivated while the other is activated. This allows for more efficient transmission of the sensor data.

[0039] According to one embodiment, the data processing unit, the sensor unit, and the at least two sensor channels are interconnected via the same communication channel or via separate communication channels. For example, a configuration is possible in which the sensor channels are interconnected via a first communication channel, and the sensor channels and the data processing unit are interconnected via a second communication channel different from the first. It is also conceivable that the sensor channels are interconnected via the same communication channel through which they are also connected to the data processing unit. Providing a common communication channel reduces the overall cost of the arrangement, while providing separate communication channels creates redundancies.

[0040] According to one embodiment, the sensor unit comprises more than two, in particular three or more, sensor channels, wherein at least one of the sensor channels includes a diagnostic unit for generating diagnostic information based on its own acquired sensor data and at least one further set of sensor data acquired by another sensor channel. In particular, each of the more than two sensor channels can be configured as described above.

[0041] According to one embodiment, the sensor arrangement has a SPI The architecture is based on the Serial Peripheral Interface (SPI), in which the data processing unit functions as an SPI master and the sensor channels each function as an SPI slave. The first and / or second sensor channel can accordingly have a first input (Chip-Select CS) for receiving a trigger or sensor data request from the data processing unit, a second input (SCLK) for receiving a clock signal from the data processing unit, a third input (Serial-Data-In SDI) for receiving (sensor) data, and / or an output (Serial-Data-Out SDO) for transmitting (sensor) data.

[0042] The second sensor channel (i.e., the sensor channel containing the diagnostic unit) can have switching elements configured to swap the third input (SDI) and output (SDO) of the second sensor channel when the first sensor channel receives a sensor data request from the data processing unit. This allows the active first SPI slave to transmit sensor data to the passive second SPI slave, which is not possible with conventional SPI architectures. Additionally or alternatively, the first sensor channel (i.e., the sensor channel not containing the diagnostic unit) can have switching elements configured to swap the third input (SDI) and output (SDO) of the first sensor channel when the second sensor channel receives a sensor data request from the data processing unit.

[0043] The switching devices can be configured to switch from the output to the third input when communication or data exchange with another sensor channel is required, and from the third input to the output when communication with the data processing unit is required. The switching devices are, for example, an electrical switch that is either an integral part of the first or second sensor channel or is located outside of the first or second sensor channel.

[0044] According to one embodiment, the sensor arrangement has a cascaded SPI architecture in which at least one of the sensor channels acts as an SPI master for at least one other sensor channel. This means the SPI architecture has three or more levels. For example, a configuration is possible in which the data processing unit acts as an SPI master for the first and second sensor channels, and the first sensor channel acts as an SPI master for the second sensor channel, or the second sensor channel acts as an SPI master for the first sensor channel. The first or second sensor channel can, in turn, act as an SPI master for a third sensor channel, and so on. It is understood that each level of the cascaded SPI architecture can also contain multiple SPI slaves and multiple SPI masters.Each level can contain a separate diagnostic unit that generates diagnostic data – as described herein – and sends it to the SPI master of the level above. This SPI master, in turn, makes the diagnostic data available to generate further diagnostic data at its own level.

[0045] The aforementioned problem is also solved by a method for providing sensor data and diagnostic information to a data processing unit of a sensor arrangement for safety-critical applications, particularly according to at least one of the preceding embodiments, as described in claim 14. The sensor arrangement comprises a data processing unit connected to a sensor unit, the sensor unit comprising at least two sensor channels and a diagnostic unit. The second sensor channel of the at least two sensor channels comprises the diagnostic unit. The first sensor channel of the at least two sensor channels does not comprise a diagnostic unit.

[0046] The procedure includes acquiring first and second sensor data through the two sensor channels of the sensor unit of the sensor arrangement, generating diagnostic information based on the first and second sensor data through the diagnostic unit, transmitting the diagnostic information to the data processing unit through the second sensor channel, and transmitting the first sensor data and the second sensor data to the data processing unit through the diagnostic unit.

[0047] According to one embodiment, the method further comprises receiving a sensor data request from the data processing unit through at least one of the sensor channels, wherein the transmission of the first sensor data or the second sensor data to the data processing unit through at least one of the sensor channels takes place in response to the receipt of the sensor data request.

[0048] According to one embodiment, the sensor data request is received before the first and second sensor data are acquired.

[0049] According to one embodiment, the first sensor data or the second sensor data are repeatedly transmitted to the data processing unit, in particular at predetermined time intervals.

[0050] According to one embodiment, the method further comprises transmitting the first and / or second sensor data between the at least two sensor channels. For example, the first and / or second sensor data are transmitted from a sensor channel having a diagnostic unit to a sensor channel without a diagnostic unit, and / or the first and / or second sensor data are transmitted from a sensor channel without a diagnostic unit to a sensor channel having a diagnostic unit.

[0051] According to one embodiment, the method further comprises transferring the diagnostic information between the at least two sensor channels. For example, the diagnostic information is transferred from a sensor channel having a diagnostic unit to a sensor channel without a diagnostic unit, and / or the diagnostic information is transferred from a sensor channel without a diagnostic unit to a sensor channel having a diagnostic unit.

[0052] According to one embodiment, first and second diagnostic information is generated based on the first and second sensor data by at least two diagnostic units, each of which is an integral part of one of the sensor channels, and the first and second diagnostic information is transmitted to the data processing unit. This means the sensor data is checked twice, which further increases safety.

[0053] The features of the sensor arrangement according to the invention can be combined arbitrarily with the features of the method according to the invention.

[0054] The invention is described below by way of example with reference to advantageous embodiments and the accompanying figures. These show, schematically: Fig. 1 a simplified representation of a sensor arrangement according to the invention, which operates on the principle of a single diagnostic cross-check, Fig. 2 a simplified representation of a sensor arrangement not independently claimed, which operates on the principle of a symmetric cross-check, Figs. 3-5 simplified representations of sensor arrangements according to the invention, which operate on the principle of an asymmetric cross-check, Fig. 6 a simplified representation of a sensor arrangement according to the invention, which operates on the principle of a cross-check between sensors, Fig. 7 a simplified representation of a sensor arrangement according to the invention, which has an SPI architecture, and Fig. 8 a flowchart of a method according to the invention for providing sensor data and diagnostic information to a data processing unit of a sensor arrangement for safety-critical applications.

[0055] The one in Fig. 1 The sensor arrangement 10 according to the invention comprises a higher-level data processing unit 12, which is connected to a sensor unit 14 via a communication channel 20. The data processing unit 12 includes a serial interface (serial peripheral interface or SPI master) and, for example, a microcontroller, a CPU, or the like. The data processing unit 12 is physically separated from the sensor unit 14; that is, the data processing unit 12 and the sensor unit 14 each have their own housing and / or separate circuit boards. The communication channel 20 can be configured as a synchronous serial data bus, an HDSL line, or the like.

[0056] The sensor unit 14 has a first sensor channel 16a and a second sensor channel 16b (e.g., SPI slaves) for acquiring first and second process data or sensor data from a safety-critical process. Sensor channels 16a and 16b each have at least one sensor for generating the sensor data (not shown). However, a single, shared sensor can also be used, which is read out in different ways to generate the various sensor data. The sensor(s) are, for example, a linear encoder and / or a rotary encoder for generating position information, where the position information specifies the relative position of the sensor arrangement 10 with respect to a measured object.

[0057] The second sensor channel 16b includes a diagnostic unit 18 for generating diagnostic information. The diagnostic unit 18 can be configured as a microcontroller, a CPU, or the like, and has its own memory. The diagnostic information indicates whether the first and second sensor data acquired by the first and second sensor channels 16a and 16b are substantially identical, or whether the difference between the first and second sensor data exceeds a predetermined threshold. The predetermined threshold is stored, for example, in the memory of the diagnostic unit 18 and can take values ​​between 0.01% and 25%, in particular 0.1% and 10%, and in particular 1% and 5%.

[0058] In a case where the diagnostic unit 18 determines that the first and second sensor data are essentially identical, that is, if the difference between the first and second sensor data does not exceed the predetermined threshold, there is no measurement error and the safety-critical process monitored by the sensor arrangement 10 continues uninterrupted. However, in a case where the diagnostic unit 18 determines that the first and second sensor data are not essentially identical, that is, if the difference between the first and second sensor data exceeds the predetermined threshold, there is a measurement error in at least one of the sensor channels 16a, 16b, and it is determined that the sensor unit 14 is in a non-safe state. In response, a suitable corrective action can be initiated.

[0059] It is understood that the comparison of the first and second sensor data is not limited to comparing the difference with a threshold value and that the comparison method can be selected as needed according to the acquired sensor data. Furthermore, it is understood that instead of the second sensor channel 16b, the first sensor channel 16a can include the diagnostic unit 18.

[0060] During the Fig. 1 In the illustrated embodiment, the data processing unit 12 sends a sensor data request to the first sensor channel 16a. In response to this request, the first sensor channel 16a transmits its own acquired first sensor data to the data processing unit 12 and to the second sensor channel 16b. The diagnostic unit 18 of the second sensor channel 16b then compares the received first sensor data with the second sensor data acquired by the second sensor channel 16b as described above and sends the diagnostic result to the data processing unit 12. The diagnostic information can be transmitted as a binary signal or as a switching signal, which, upon receipt, causes the data processing unit 12 to change an operating state of the sensor arrangement 10. This change in the operating state, for example, results in the initiation of a corrective action with respect to the safety-critical process.

[0061] The cross-check of the first and second sensor data is therefore outsourced from data processing unit 12 to sensor unit 14, and only one set of sensor data and the already generated test result are transferred to data processing unit 12. This significantly reduces the computational load on data processing unit 12 as well as the amount of data to be transferred from sensor unit 14 to data processing unit 12.

[0062] All data exchange between the data processing unit 12 and the sensor channels 16a and 16b takes place via the common communication channel 20. Alternatively, the initial sensor data and / or diagnostic information can also be transmitted periodically to the data processing unit 12.

[0063] The one in Fig. 2 The embodiment of a sensor arrangement 10 shown, which is not according to the invention, differs from the one shown in the Fig. 1 shown essentially by the fact that both sensor channels 16a, 16b have a diagnostic unit 18a, 18b.

[0064] During the Fig. 2 In the embodiment shown, both sensor channels 16a, 16b receive a sensor data request from the data processing unit 12. In In response, the first sensor channel 16a transmits its own acquired initial sensor data to the data processing unit 12 and the second sensor channel 16b. Also in response to receiving the sensor data request, the second sensor channel 16b transmits its own acquired second sensor data to the first sensor channel 16a.

[0065] The diagnostic unit 18a of the first sensor channel 16a and the diagnostic unit 18b of the second sensor channel 16b each generate first and second diagnostic information, respectively. The first sensor channel 16a transmits the first diagnostic information to the data processing unit 12, and the second sensor channel 16b transmits the second diagnostic information to the data processing unit 12. This means the sensor data is checked twice, which further increases security. Additionally, it is conceivable that the data processing unit 12 and / or at least one of the diagnostic units 18a, 18b is configured to perform a cross-check of the first and second diagnostic information.

[0066] The one in Fig. 3 The embodiment of a sensor arrangement 10 shown according to the invention differs from the one shown in the Fig. 1 This is essentially demonstrated by the fact that data exchange between the data processing unit 12 and the sensor unit 14 takes place via a first communication channel 20, and data exchange between the sensor channels 16a and 16b takes place via a second communication channel 22. The first communication channel 20 is represented here purely schematically by three arrows between the data processing unit 12 and the sensor unit 14.

[0067] More precisely, the transmission of the sensor data request from data processing unit 12 to the first sensor channel 16a, the transmission of the first sensor data from the first sensor channel 16a to data processing unit 12, and the transmission of the first sensor data from the first sensor channel 16a to the second sensor channel 16b all occur via the first communication channel 20. The transmission of the diagnostic information generated by the diagnostic unit 18 of the second sensor channel 16b from the second sensor channel 16b to the first sensor channel 16a occurs via the second communication channel 22. The transmission of the diagnostic information from the first sensor channel 16a to data processing unit 12 again occurs via the first communication channel 20.

[0068] The one in Fig. 4 The embodiment of a sensor arrangement 10 shown according to the invention differs from the one shown in the Fig. 3 This is shown essentially by the fact that the transmission of the first sensor data from the first sensor channel 16a to the second sensor channel 16b does not occur via the first communication channel 20 but via the second communication channel 22. The second communication channel 22 is schematically represented here by two opposing arrows between sensor channels 16a and 16b in the lower part of the image.

[0069] The one in Fig. 5 The embodiment of a sensor arrangement 10 shown according to the invention differs from the one shown in the Fig. 4 shown essentially by the fact that the second sensor channel 16b, which has a diagnostic unit 18, does not transmit the generated diagnostic information to the first sensor channel 16a but directly to the data processing unit 12.

[0070] The one in Fig. 6 The embodiment of a sensor arrangement 10 shown according to the invention differs from the one shown in Fig. 5 shown essentially by the fact that the data processing unit 12 only communicates with the (first) sensor channel 16a which has the diagnostic unit 18.

[0071] More precisely, a sensor data request is received by the data processing unit 12 via the first sensor channel 16a. In response, the first sensor channel 16a transmits its own acquired initial sensor data to the data processing unit 12. Simultaneously or with a time delay, the second sensor channel 16b, which in this case does not include a diagnostic unit 18, transmits its own acquired secondary sensor data to the first sensor channel 16a. Subsequently, the diagnostic unit 18 of the first sensor channel 16a generates diagnostic information, i.e., it compares the first and second sensor data as described above. The first sensor channel 16a then transmits the diagnostic result to the data processing unit 12.

[0072] The one in Fig. 7 The illustrated sensor arrangement 10 has an SPI architecture in which the data processing unit 12 functions as an SPI master and the sensor channels 16a and 16b each function as an SPI slave. In the illustrated embodiment, the second sensor channel 16b, which includes the diagnostic unit 18, has an SPI slave unit 26. This unit has a first input CS ("Chip Select") for receiving a sensor data request from the data processing unit 12, a second input SCLK for receiving a clock signal from the data processing unit, a third input SDI for receiving (sensor) data, and an output SDO for transmitting (sensor) data. The SPI slave unit 26 performs the functions of an SPI slave.

[0073] The second sensor channel 16b further features switching devices 24 in the form of a 2x2 crossbar switch, configured to swap the third input SDI and the output SDO of the SPI 26 when the SPI slave unit 26 is not communicating with the data processing unit 12. The corresponding inputs and outputs of the switching devices 24 are accordingly designated SDIO1 and SDIO2. Thus, when the switching devices 24 swap the inputs and outputs, the active first sensor channel 16a, which also includes an SPI slave unit (not shown), can transmit sensor data to the passive second SPI slave 16b, which is not possible with conventional SPI architectures.

[0074] The Fig. 8 Figure 1 shows a schematic flowchart of a method 100 according to the invention for providing sensor data and diagnostic information to a data processing unit 12 of a sensor arrangement 10 for safety-critical applications. The method begins with step 110, in which a sensor data request is received by the data processing unit 12 through at least one of the sensor channels 16a, 16b of the sensor unit 14. In step 120, first and second sensor data are acquired from the first and second sensor channels 16a, 16b, respectively. In step 130, diagnostic information based on the first and second sensor data is generated by at least one diagnostic unit 18, 18a, 18b, which is an integral part of at least one of the sensor channels 16a, 16b. In step 140, the generated diagnostic information is transmitted to the data processing unit 12 through at least one of the sensor channels 16a, 16b.In step 150, either the first sensor data or the second sensor data is transmitted to the data processing unit 12 via at least one of the sensor channels 16a, 16b, or via only one of the sensor channels 16a, 16b. Specifically, the first and second sensor data are not transmitted to the data processing unit 12. In step 160, the data processing unit 12 determines whether the sensor unit 14 is in a safe or a non-safe state. A non-safe state exists, in particular, if the diagnostic information indicates that a measurement error has occurred. In response, the sensor arrangement 10, and in particular the data processing unit 12, can initiate a corrective action with respect to the safety-critical process.

[0075] It is understood that, for the sake of simplicity, the invention is described only by way of example with reference to two sensor channels 16a, 16b, and that the sensor unit 14 can comprise more than two sensor channels 16a, 16b. The sensor arrangement can, for example, have a cascaded SPI architecture with three or more sensor channels 16, in which, however, only sensor data from a single sensor channel 16 and diagnostic information are transmitted to the data processing unit 12.

[0076] It is also understood that features or sets of features described in relation to specific embodiments can be combined with features or sets of features of other embodiments. Bezugszeichenliste:

[0077] 10 Sensor arrangement 12 Data processing unit 14 Sensor unit 16a, 16b Sensor channels 18 Diagnostic unit 20, 22 Communication channels 24 Switching device 26 SPI slave unit

Claims

1. A sensor arrangement (10) for safety-critical applications, comprising a data processing unit (12) which is connected to a sensor unit (14); wherein the sensor unit (14) comprises at least two sensor channels (16a, 16b) for detecting first and second sensor data and a diagnostic unit (18) for generating diagnostic information on the basis of the first and second sensor data, wherein the second sensor channel (16b) of the at least two sensor channels (16a, 16b) comprises the diagnostic unit (18), and wherein the second sensor channel (16a, 16b) is set up and configured to transmit the diagnostic information to the data processing unit (12), characterized in that the first sensor channel (16a) of the at least two sensor channels (16a, 16b) does not comprise a diagnostic unit (18), and in that the diagnostic unit (18) of the second sensor channel (16b) is set up and configured to transmit the first sensor data and the second sensor data to the data processing unit (12).

2. A sensor arrangement (10) according to claim 1, wherein the second sensor channel (16b) is set up and configured to transmit the first sensor data or the second sensor data and the diagnostic information to the data processing unit (12).

3. A sensor arrangement (10) according to claim 1, wherein the first sensor channel (16a) is set up and configured to transmit the first sensor data or the second sensor data and the diagnostic information to the data processing unit (12).

4. A sensor arrangement (10) according to claim 1, wherein the second sensor channel (16b) is set up and configured to transmit the first sensor data or the second sensor data to the data processing unit (12), and wherein the first sensor channel (16a) is set up and configured to transmit the diagnostic information to the data processing unit (12).

5. A sensor arrangement (10) according to claim 1, wherein the second sensor channel (16b) is set up and configured to transmit the diagnostic information to the data processing unit (12), and wherein the first sensor channel (16a) is set up and configured to transmit the first sensor data or the second sensor data to the data processing unit (12).

6. A sensor arrangement (10) according to at least one of the preceding claims, wherein the data processing unit (12) and the sensor unit (14) are separate units, in particular wherein the data processing unit (12) and the sensor unit (14) each have their own housing.

7. A sensor arrangement (10) according to at least one of the preceding claims, wherein the first and / or second sensor channel (16a, 16b) comprises / comprise a sensor for generating the first and / or second sensor data, in particular wherein the first and / or second sensor channel (16a, 16b) comprises / comprise a linear encoder and / or a rotary encoder for generating position information.

8. A sensor arrangement (10) according to at least one of the preceding claims, wherein the diagnostic unit (18) is set up and configured to generate the diagnostic information as a binary signal or as a switching signal which, upon reception, causes the data processing unit (12) to change an operating state of the sensor arrangement (10).

9. A sensor arrangement (10) according to at least one of the preceding claims, wherein the diagnostic unit (18) is set up and configured to generate the diagnostic information by comparing the first and second sensor data, in particular wherein, in a case in which a deviation between the first and second sensor data exceeds a predetermined threshold value, the diagnostic information indicates a fault and, in a case in which a deviation between the first and second sensor data does not exceed the predetermined threshold value, the diagnostic information indicates that there is no fault.

10. A sensor arrangement (10) according to at least one of the preceding claims, wherein the first and / or second sensor channel (16a, 16b) is / are set up and configured to transmit the first sensor data or the second sensor data to the data processing unit (12) in response to receiving a sensor data query from the data processing unit (12), or to transmit the first sensor data or the second sensor data repeatedly to the data processing unit (12), in particular at predetermined time intervals.

11. A sensor arrangement (10) according to at least one of the preceding claims, wherein the data processing unit (12) and the sensor unit (14) and / or the at least two sensor channels (16a, 16b) are connected to one another via a communication channel (20), in particular via a synchronous serial data bus, an HDSL line and / or a point-to-point communication.

12. A sensor arrangement (10) according to at least one of the preceding claims, wherein the data processing unit (12) and the sensor unit (14) and the at least two sensor channels (16a, 16b) are connected to one another via the same communication channel (20) or via separate communication channels (20, 22).

13. A sensor arrangement (10) according to at least one of the preceding claims, wherein the sensor unit (14) comprises more than two, in particular three or more, sensor channels (16a, 16b), wherein at least one of the sensor channels (16a, 16b) comprises a diagnostic unit (18) for generating diagnostic information on the basis of separately acquired sensor data and at least one further set of sensor data that were acquired by another sensor channel (16a, 16b).

14. A method (100) for providing sensor data and diagnostic information to a data processing unit (12) of a sensor arrangement (10) for safety-critical applications, the sensor arrangement (10) comprising a data processing unit (12) which is connected to a sensor unit (14), wherein the sensor unit (14) comprises at least two sensor channels (16a, 16b) and a diagnostic unit (18), wherein the second sensor channel (16b) of the at least two sensor channels (16a, 16b) comprises the diagnostic unit (18), and wherein the first sensor channel (16a) of the at least two sensor channels (16a, 16b) does not comprise a diagnostic unit (18), the method comprising: acquiring (120) first and second sensor data by means of the two sensor channels (16a, 16b) of the sensor unit (14) of the sensor arrangement (10); generating (130) diagnostic information on the basis of the first and second sensor data by means of the diagnostic unit (18); and transmitting (140) the diagnostic information to the data processing unit (12) by means of the second sensor channel (16b), transmitting (150) the first sensor data and the second sensor data to the data processing unit (12) by means of the diagnostic unit (18).

15. A method (100) according to claim 14, further comprising receiving (110) a sensor data query from the data processing unit (12) by means of at least one of the sensor channels (16a, 16b), wherein the transmission of the first sensor data or the second sensor data to the data processing unit (12) by one of the sensor channels (16a, 16b) takes place in response to receiving the sensor data query.