Method for forwarding data from a plurality of data sources to a data sink

Abstract

According to various embodiments, a method is described for forwarding data from a plurality of data sources (203) to a data sink (205), said method comprising: forwarding data received from a first data source and forwarded from a comparison device (204) by means of a monitoring device (206) to the data sink (205) before the monitoring device (206) has received control information, which displays a result of a comparison of the data received from the first data source with data received from one or more second data sources (203), from the comparison device (204) and, if the monitoring device (206) has not received the control information, which displays a result of the comparison, from the comparison device within an error detection period after the received data have been forwarded to the data sink (205), or the control information displays a negative result, signalling a fault state to the data sink (205).

Description

[0001] Method for forwarding data from a plurality of data sources to a data sink

[0002] The present disclosure relates to methods for forwarding data from a plurality of data sources to a data sink.

[0003] Technical systems, for example in the automotive sector, place very high demands on the reliability of their functionality (i.e., systems with simultaneously high requirements for the correctness of the provided data, outputs, or signals and / or their timely availability). One example of systems with particularly demanding reliability requirements is "steer-by-wire" control systems.

[0004] Typically, N redundant data sources (such as functions or data channels) are used in such systems, in particular to safeguard data provision and / or data processing against incorrect results or failures.

[0005] Depending on the number of redundant data sources, errors can either be detected only once (in this case, N >= 2) or errors / failures can even be temporarily compensated (in this case, N >= 3). In both cases, a so-called comparator (or "voter") is typically used, which compares the results of the N data sources and then decides which data (e.g., outputs or signals) are considered correct and forwarded to a data sink.

[0006] However, depending on the system in which such an approach is used, delays may occur if the comparator waits until it has received data from all data sources (e.g., across all N channels) so that it can perform the comparison, but the data provision from one of the data sources is delayed (e.g., because one channel is currently too slow). Therefore, approaches are desirable that enable the data to be forwarded to a data sink with minimal delay, even when data reliability is high.

[0007] According to various embodiments, a method for forwarding (payload) data from a plurality of data sources to a data sink is provided, comprising forwarding data received from a first data source and forwarded by a comparison device to the data sink by a monitoring device before the monitoring device has received control information indicating a result of a comparison of the data received from the first data source with data received from one or more second data sources from the comparison device, and, if the monitoring device has not received the control information indicating a result of the comparison from the comparison device within a (predetermined) error detection time after forwarding the received data to the data sink, or the control information indicates a negative result, signaling (e.g.from the monitoring device) of an error condition to the data sink.

[0008] In the method described above and the embodiments described below, the data stream and error detection are decoupled. This allows for virtually latency-free protection of a data stream, e.g., using an M-out-of-N comparison scheme, without significantly limiting integrity monitoring. While, with forwarding, the end-to-end latency of a (data processing) cycle is determined by the slowest channel only after the comparison result is available, the method described above allows the end-to-end latency of a data processing cycle to be determined by the fastest channel.

[0009] Furthermore, there is the possibility of reusability and integration: The separation of comparator (comparison device) and decider (monitoring device) enables the reuse of a common "FIFO comparator" for multiple applications, whereby all applications receive the same control information and each integrates its own instance of a decider with application-specific monitoring parameters and error reactions.

[0010] The separation of comparator and decision maker, as well as of data stream and error detection, further enables good scalability, e.g., through the cascaded use of multiple consecutive FIFO comparators in larger distributed systems with multiple data sources and processing paths (which then, for example, together form a comparator), with control information being aggregated. The evaluation of the aggregated control information (from the consecutive FIFO comparators) can be performed centrally in the monitoring device provided for the data sink (e.g., at the data sink).

[0011] Various examples of implementation are given below.

[0012] Embodiment 1 is a method for forwarding data from a plurality of data sources to a data sink as described above.

[0013] Embodiment 2 is a method according to embodiment 1, comprising receiving the data from the first of the data sources by the comparison device, forwarding the data received from the first data source by the comparison device to the monitoring device before the comparison device has completed the comparison, performing the comparison by the comparison device and transmitting the control information indicating a result of the comparison from the comparison device to the monitoring device;

[0014] By forwarding the information from the comparison device to the monitoring device before the comparison is completed, the delay can be kept to a minimum.

[0015] Embodiment 3 is a method according to embodiment 1 or 2, comprising signaling a first error state by the monitoring device to the data sink if the monitoring device has not received the control information indicating a result of the comparison from the comparison device within an error detection time after forwarding the received data to the data sink, and signaling a second error state by the monitoring device to the data sink if the control information indicates a negative result

[0016] The data sink can then react differently depending on whether the forwarded data was faulty (which is indicated by the negative comparison result, i.e., lack of agreement between the data received from the data sources), or whether the data could not yet be verified (i.e., the error detection time has expired).

[0017] Embodiment 4 is a method according to any one of embodiments 1 to 3, wherein the comparison is an M-out-of-N comparison.

[0018] Accordingly, the comparison result is negative if the data (for the same processing cycle) from fewer than M data sources match. The desired level of certainty can be achieved by choosing M and N.

[0019] Embodiment 5 is a method according to any one of embodiments 1 to 3, comprising performing the forwarding for data received from the data sources for each of a plurality of processing cycles and further comprising triggering a reconfiguration for a data source for which a number of processing cycles for which the respective comparison has indicated that the data from the data source is erroneous, or for which the data from the data source was received from the comparison device with a delay above a delay threshold.

[0020] For example, a reconfiguration (e.g., moving software implementing the data source to different hardware or another orchestration measure) may be performed if the data from the data source was repeatedly faulty or the data was repeatedly received from the data source so late that it could not be used for comparison, so that the comparison result could or should have been forwarded to the monitoring device within the error detection time.

[0021] For this purpose, it can be provided that when an error condition is signalled, information about the faulty data source(s) (because they produce delayed results or results that deviate from the majority) is also transmitted.

[0022] Embodiment 6 is a data processing arrangement configured to carry out a method according to one of the embodiments 1 to 5.

[0023] Depending on the situation, the communication system may contain only the monitoring device or also the monitoring device, the comparison device and / or the data sinks, i.e. the data processing arrangement may be a communication system or only parts thereof.

[0024] Embodiment 7 is a computer program including instructions that, when executed by one or more processors, cause the one or more processors to perform a method according to any one of embodiments 1 to 5.

[0025] Embodiment 8 is a computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform a method according to any one of embodiments 1 to 5.

[0026] Various examples are described in more detail below.

[0027] In the drawings, like reference characters generally refer to the same parts throughout the several views. The drawings are not necessarily to scale, emphasis instead generally being placed upon illustrating the principles of the invention. In the following description, various aspects are described with reference to the following drawings.

[0028] Figure 1 shows a communication system. Figure 2 shows a communication system according to one embodiment.

[0029] Figure 3 shows a flowchart illustrating a method for forwarding data from a plurality of data sources to a data sink according to one embodiment.

[0030] The following detailed description refers to the accompanying drawings, which, by way of illustration, show specific details and aspects of this disclosure in which the invention may be practiced. Other aspects may be utilized, and structural, logical, and electrical changes may be made without departing from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0031] The process of decision-making is a well-known problem in computer science, particularly in distributed, fault-tolerant computing systems or systems that seek to reach agreement on a single data value. Algorithms for solving this problem are known as consensus algorithms.

[0032] Such algorithms are typically used in large, distributed applications operated in data centers. Examples of well-known algorithms are the Paxos algorithm and the Raft algorithm. Both are based on the principle that decisions are made by majority vote. If this is not possible, a so-called master node makes the final decision. However, such methods require a certain amount of bidirectional communication between the participating nodes, which results in additional latency compared to the processing chain. Due to this nature, the use of such algorithms in the context of real-time systems with strict latency requirements is unusual. Instead, M-out-of-N schemes are used in such cases, as described below with reference to Figure 1.

[0033] Figure 1 shows a communication system (or processing system, hereinafter also simply referred to as "system") 100. A receiver 101 receives data from multiple data sources, wherein the data sources are formed by a single data generator 102 (e.g., a sensor) that transmits data via multiple channels 103 (i.e., each of the multiple data sources corresponds to a combination of data generator 102 and respective channel). However, the data sources can also be separate data generators (e.g., separate sensors), each connected to the receiver 101 via a channel 103. The data generator 102 can also itself be an input (e.g., a receiver).

[0034] The receiver 101 contains a comparator 104 which compares data received from the data sources (i.e. via the channels in this example) and, if there is a sufficient match, forwards it to a data sink 105 (e.g. a control device, e.g. a control unit (ECU) in a vehicle which controls an actuator, such as a brake, for an ABS (anti-lock braking system) or an ESP (electronic stability program)). Sufficient match here means, for example, an M-out-of-N match, i.e. a match of (at least) M data packets among N received data packets, where the data packets correspond to one another, i.e. belong to the same (data) processing cycle, e.g. have the same sequence number from a data stream (e.g. are for the same data processing cycle, e.g. control cycle, of a sequence of data processing cycles).

[0035] The communication system 100 thus implements, for example, a so-called M-out-of-N comparison scheme. In (communication) systems with high safety integrity requirements, the data (e.g., outputs from a sensor or other signals) of the N channels are typically compared for each cycle in which new data is provided. For example, for a control interval of, say, 50 ms, a comparison of the incoming data takes place in the same interval, as well as a direct decision as to whether the system is operating correctly or whether an error has occurred and the data must be discarded.

[0036] Such M-out-of-N comparison schemes are typically used for (safety-relevant) real-time systems only with spatially close, usually locally networked, and closely synchronized (usually embedded) system components. Such systems consisting of locally networked components are typically well synchronized with each other, for example, via a global clock (in the local system) against which all system components regularly synchronize. This makes it possible to keep the execution of the data processing steps between the N channels 103 and the subsequent comparator 104 synchronized. The close time synchronization makes it possible for the comparator to process each comparison in each data processing cycle with virtually no delay.Therefore, the data provision to the data sink 105 in such a local networked system occurs with a very small additional latency compared to the processing chain in a single-channel system without redundancies and comparators.

[0037] In widely distributed systems whose components are interconnected, for example, via the Internet or other public and shared networks (e.g., mobile networks) (i.e., where channels 103 are provided by such networks), it is significantly more difficult to implement a multi-comparison scheme to ensure reliability requirements (regarding integrity and timely availability of data) due to the following differences compared to a system with fast (e.g., locally) interconnected components:

[0038] 1) There is generally no precise common time base between the components; because of (2) it is difficult to establish a precise common time base and keep it synchronized

[0039] 2) The transmission times of individual messages / data packets vary greatly in packet-based, dynamically routed network communication. For example, during periods of high network load, packets may arrive significantly later (or not at all) than would be the case during periods of low network load or on average.

[0040] 3) Defects or temporary disruptions in the transmission link may lead to communication failures or delays between individual system components. Wireless connections (e.g. for V2X communication channels) are generally more susceptible to interference than wired connections. If an M-out-of-N scheme as described with reference to Figure 1 is used in such a widely distributed networked system, whereby a high level of data integrity (i.e. faulty content is identified as faulty sufficiently quickly) and timeliness of the data (e.g. current data in cycles of 20ms each) are required at the same time, difficulties arise, as summarized in Table 1 as an example for a 2-out-of-3 scheme and explained below. For each processing cycle, it is specified which data the respective channel is currently supplying (which may still be data for the previous processing cycle, since this and the current data are delayed).

[0041] Table 1

[0042] Case 1 (Waiting for data for comparison): If the comparator 104 waits for the input of all data / signals / outputs from the N channels in a cycle z1 in order to ensure the integrity of the cycle, then in widely distributed systems there is a non-negligible probability that, due to one of the three aforementioned properties, at least one of the N channels will experience a delay in the provision of results, thus violating the real-time requirements (i.e., z1 exceeds its maximum permitted time window). This is illustrated in Table 1 in column z1 as an example for the 3-out-of-3 comparison.

[0043] Case 2 (Direct Forwarding): If a time-optimized "first-in, first-out" behavior is chosen (i.e., comparator 104 only compares the data currently available and forwards data without checking if it cannot be falsified in time), there is a risk that faulty data will be received at the data sink, which can no longer be identified as faulty there. Such a case is shown, for example, in Table 1 in columns z2 and z3.

[0044] In both cases, at least one of the requirements (high integrity and timeliness, i.e., low latency) is violated. Furthermore, an additional (variable) processing latency in the form of the waiting time in the comparator is added to the processing chain. In the more favorable case 1, a controlled error response occurs, e.g., by disabling or interrupting a functionality in the data sink 105. In the less favorable case 2, errors are propagated unnoticed to the data sink 105. Since case 1 is frequently to be expected in widely distributed networked systems, this concept is not well suited for many applications in practice. One reason for this is potential network problems that may have a direct impact on system behavior and result in frequent functional degradations in the data sink 105.

[0045] According to various embodiments, an approach is provided that enables the implementation of real-time and safety-critical applications even in geographically widely distributed and (in the most difficult case, wirelessly) networked systems. For this purpose, as described below, an approach is provided that enables the use of an M-out-of-N comparison scheme in distributed systems without excessively restricting the achievable requirements regarding integrity and / or receiving the data / signals at the right time (i.e., low latency). For this purpose, according to various embodiments, the functionality of the comparator 104 is distributed. Figure 2 shows a communication system 200 according to one embodiment.

[0046] Analogous to the communication system 100 of Figure 1, the communication system 200 comprises a receiver 201, a data generator 202, several channels 203, and a data sink 205. As explained above with reference to Figure 1, a separate data generator can also be provided for each data source.

[0047] The communication system 200 differs from the communication system 100 of Figure 1 in that, instead of the comparator 104, a FIFO (First-In-First-Out) comparator 204 (in the receiver 201) is provided, followed by a monitoring device 206 (or decision device, hereinafter also referred to as a (meta-data) watchdog). The monitoring device 206 is typically geographically close to the data sink 205, e.g., it can be provided together with the data sink 205 in one component (e.g., in one device). The receiver 201, on the other hand, can be located in a separate component.

[0048] The FIFO comparator 204 and the monitoring device 206 implement a two-part M-out-of-N comparison scheme, enhanced with cycle-related meta-information. This exploits the fact that safety-relevant real-time applications generally have a so-called fault tolerance time interval (FTTI), during which an error propagated between the components in the system cannot yet cause dangerous consequences. As an example, consider a braking process from the automotive sector. A fault-related braking intervention lasting a few milliseconds only leads to a brief jolt in the vehicle, which impairs driving comfort but not safety. Part of this application-specific

[0049] Fault tolerance time intervals are used in the extended comparison scheme for time-delayed error detection (as error detection time (interval) FDTI), during which (useful) data can be forwarded to the subsequent system components almost without delay.

[0050] The FIFO comparator 204 and the monitoring device 206 have the following functionalities:

[0051] • The FIFO comparator (also referred to as comparison device) 204 performs a retrospective M-out-of-N comparison based on (e.g., temporarily stored) meta-information about the received data and then sends the comparison result to the monitoring device 206 in the form of (meta-) control information (e.g., via a separately sent safety meta-data signal).

[0052] • The monitoring device 206 monitors the data forwarding based on the control information generated by the FIFO comparator by evaluating the control information and, in the event of an error or if positive control information is absent, triggering an error response in the data sink 205 (e.g., deactivating selected functions). In addition, according to one embodiment, the monitoring device 206 implements extended error diagnostic measures (also based on the control information) in order to, for example, identify a persistently unreliable channel 203 and, if necessary, automatically restore the desired reliability of the overall system by reconfiguring the unreliable channel at runtime.

[0053] In the following, the functionalities of the FIFO comparator 204 and the monitoring device (watchdog) 206 are described in more detail according to an embodiment.

[0054] The FIFO comparator 204 processes all data associated with a new cycle in two phases.

[0055] In phase 1, the FIFO comparator 204 receives (payload) data (or signals / outputs) for a current comparison cycle. Due to the aforementioned slight asynchrony, the data first arrives at the FIFO comparator 204 from one of the N redundant channels 203, and is then forwarded (with a slight delay) to the watchdog 206 without being checked. During the data forwarding process, the FIFO comparator also adds the following meta-information:

[0056] • Number / ID of the channel or application / function through which the data was received

[0057] • Sequence number / ID which identifies the data as belonging to a cycle

[0058] In parallel, the FIFO comparator 204 internally stores the meta-information about the forwarded data and, in phase 2, performs a retrospective comparison between the data of a cycle whenever the data (belonging to the same cycle) has been received from at least one other of the remaining N-1 channels. In this case, up to N-1 comparisons are performed between the (in error-free case) same data of a cycle and (meta-

[0059] ) Control information is updated with the results of the last comparison. In one embodiment, control information is always transmitted to the decision maker when a further comparison of the payload data of a cycle has taken place (namely when data for the processing cycle in question has been received from another data source). For example, the first control information is created and sent to the watchdog when the data of a cycle from at least two out of N channels is present in the FIFO comparator, so that a first (2-out-of-N) comparison is possible. The results of this first comparison are then sent to the watchdog 206 so that it can decide whether an acknowledgment from two channels is already sufficient or whether to wait for acknowledgment from further channels before the data is considered sufficiently verified for use in the data sink (i.e. the watchdog 206 can select M accordingly).

[0060] A failure of the (FIFO) comparator 204 and / or the transmission of control information can be detected in the watchdog 206 via so-called timeout monitoring. In a variant in which the FIFO comparator 204 is implemented entirely in software, automated repair attempts for a malfunctioning FIFO comparator 204 can be triggered, for example, by the watchdog 206. The FIFO comparator software is transferred to another execution platform, e.g., using suitable virtualization technology and configuration commands (tftd) to an orchestration software, and can resume operation there after successful migration.

[0061] To prevent the amount of information about already forwarded data that must be retained in the FIFO comparator 204 from continually increasing over time, in one embodiment, outdated data is deleted there after a certain time (e.g., data that was already forwarded a configurable number of seconds ago). Using a unique sequence number assigned to each cycle, outdated data (e.g., data coming from a channel whose data reaches the FIFO comparator much too late) can also be filtered directly from the data stream, so that no unnecessary resources are occupied in the FIFO comparator 204 and in the further network communication with the watchdog 206. This sequence number can be set either by the respective data source itself, for example, as part of a header field within the payload, or by appropriately setting header fields in the underlying transport protocol.

[0062] The (metadata) watchdog 206 also operates in two distinct phases. In phase 1 (information retrieval), the watchdog 206 receives new payload data from the FIFO comparator 204, including initial meta information (i.e., channel number / ID, forwarding timestamp, data sequence number, etc.), and stores this internally using a local timestamp. It then checks, based on the meta information (e.g., sequence number), whether this payload data has already been forwarded to the data sink 205. If this is the case, the data is discarded. If the payload data is new (i.e., not yet forwarded), it forwards it to the data sink 205. It also starts a backward-running error detection timer for forwarded payload data of a cycle (i.e., payload data with its own sequence number / ID). The duration corresponds to the maximum desired error detection time (FDTI) of the respective application.

[0063] In phase 2 (verification and retrospection by examining the control information generated by comparator 204, which indicates the result of the retrospective comparison), which is initiated by starting the error detection timer, the watchdog waits for further meta-information from the FIFO comparator, which is required to verify or falsify the data already forwarded. If such a timer reaches the value zero before watchdog 206 has received control information from comparator 204 indicating that the payload data could be sufficiently verified by receiving further associated data (e.g., data packets with the same sequence number or ID) from another channel, the watchdog considers the payload data to be faulty.

[0064] As soon as new control information arrives in Watchdog 206, it checks whether the data already forwarded is (at least partially) verified or possibly falsified.

[0065] Table 2 illustrates the process in FIFO comparator 204, for example, when it receives data from three sources (S1, S2, S3), i.e., N = 3. Table 3 shows the corresponding generation of (meta) control information by FIFO comparator 204.

[0066] Table 4 illustrates the process in the monitoring device 206 for the example, specifically which data is forwarded from the monitoring device 206 to the data sink 205.

[0067] Table 5 shows the evaluation of the control information in the watchdog 206 for the example. The transmission of the control information from the comparator 204 to the monitoring device 206 takes 10 ms in this example.

[0068] The example spans multiple processing cycles. The sequence number (Seq. No.) indicates the respective processing cycle of the application to be monitored.

[0069] In the example shown in Tables 2 to 5, a 2-out-of-3 comparison scheme is used. The maximum error detection time in this example is 100 ms.

[0070] Table 2

[0071] Table 3

[0072] Table 4

[0073] Table 5

[0074] If the control information identifies forwarded data from a processing cycle as faulty, Watchdog 206 checks in phase 2 of processing whether the data already forwarded in the affected processing cycle was based on a channel identified as faulty or a channel verified as correct. The following cases can occur:

[0075] 1) If the retrospective comparison (or retrospective review, ie the retrospective review of the associated

[0076] If the control information reveals that the forwarded data was correct (i.e., the result of the M-out-of-N comparison in the retrospective comparison by the comparator 204 was positive), no further actions are required by the watchdog 206. In phase 1, no faulty data was forwarded to the data sink 205.

[0077] 2) If the retrospective comparison reveals that the forwarded data was faulty, then a (time-limited) error propagation to the data sink 205 took place and the watchdog 206 signals this to the data sink 205. The data sink then triggers an appropriate error reaction, e.g. a functional restriction, if necessary.

[0078] 3) If the cycle-related error detection timer expires before 1) or 2) occurs, the forwarded data is assumed by the watchdog to be potentially faulty and appropriate signaling is performed by the watchdog 206 and, if necessary, an appropriate error reaction is performed in the data sink 205.

[0079] The described mechanisms in the watchdog 206 ensure that faulty data is always identified as such within the error detection time FDTI and that the effect of an error can be stopped in a timely manner without the latency of the data processing chain being significantly increased in the error-free case by the M-out-of-N comparison scheme described here.

[0080] In summary, according to various embodiments, a method is provided as shown in Figure 3.

[0081] Figure 3 shows a flowchart 300 illustrating a method for forwarding data from a plurality of data sources to a data sink according to one embodiment.

[0082] In 301, data received from a first data source and forwarded by a comparison device is forwarded to the data sink by a monitoring device before the monitoring device has received control information from the comparison device indicating a result of a comparison of the data received from the first data source with data received from one or more second data sources. In 302, if the monitoring device has not received the control information indicating a result of the comparison from the comparison device within an error detection time after forwarding the received data to the data sink, or if the control information indicates a negative result, an error condition is signaled to the data sink.

[0083] The method of Figure 3 may be performed by one or more computers having one or more data processing units. The term "data processing unit" may be understood as any type of entity that enables the processing of data or signals. The data or signals may, for example, be processed according to at least one (i.e., one or more than one) specific function performed by the data processing unit. A data processing unit may comprise or be formed from an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a programmable gate array (FPGA) integrated circuit, or any combination thereof.Any other way of implementing the respective functions described in more detail herein may also be understood as a data processing unit or logic circuit arrangement. One or more of the method steps described in detail herein may be performed (e.g., implemented) by a data processing unit through one or more specific functions performed by the data processing unit.

[0084] According to various embodiments, the method is therefore particularly computer-implemented.

[0085] The method can be used for various systems with multiple data sources, especially those that have high requirements for reliability and / or latency. Examples are

[0086] • Electronic Control Units (ECUs) in vehicles, for example for powertrain controllers, braking systems, assistance systems, etc. • Fieldbus Programmable Logic Controllers (PLC), also virtualized versions, in the industrial sector

[0087] • Other control devices, especially in the above-mentioned areas, such as network gateways

[0088] An application example is a vehicle with integrated sensors and sensors mounted on a road (external from the vehicle's perspective) connected via a wireless network as data sources, whereby a comparison device is installed in the vehicle which monitors the redundant information of the integrated and external sensors according to the presented method.

[0089] Another application example is a computer-aided process control of a production plant, in which control algorithms are redundantly calculated on several different computers to increase reliability and safety integrity, and their resulting control commands are monitored in a special safety controller (so-called "safety programmable logic controller") by means of a comparison device according to the presented method.

Claims

Claims 1 . A method for forwarding data from a plurality of data sources (203) to a data sink (205), comprising: forwarding data received from a first data source and forwarded by a comparison device (204) by a monitoring device (206) to the data sink (205) before the monitoring device (206) has received control information from the comparison device (204) indicating a result of a comparison of the data received from the first data source with data received from one or more second data sources (203); and If the monitoring device (206) has not received the control information indicating a result of the comparison from the comparison device (204) within an error detection time after forwarding the received data to the data sink (205), or the control information indicates a negative result, signaling an error state to the data sink (205).

2. The method according to claim 1, comprising receiving the data from the first of the data sources (203) by the comparison device (204), forwarding the data received from the first data source by the comparison device (204) to the monitoring device (206) before the comparison device (204) has completed the comparison, performing the comparison by the comparison device (204) and transmitting the control information indicating a result of the comparison from the comparison device (204) to the monitoring device (206).

3. Method according to claim 1 or 2, comprising signaling a first error condition by the monitoring device (206) to the Data sink (205), if the monitoring device (206) has not received the control information indicating a result of the comparison from the comparison device (204) within an error detection time after forwarding the received data to the data sink (205), and signaling a second error state by the monitoring device (206) to the data sink (205) if the control information indicates a negative result 4. The method according to any one of claims 1 to 3, wherein the comparison is an M-out-of-N comparison.

5. The method according to any one of claims 1 to 4, comprising performing the forwarding for data received from the data sources (203) for each of a plurality of processing cycles and further comprising triggering a reconfiguration for a data source for which a number of processing cycles for which the respective comparison has indicated that the data from the data source is erroneous, or for which the data from the data source was received from the comparison device (204) with a delay above a delay threshold.

6. Data processing arrangement arranged to carry out a method according to one of claims 1 to 5.

7. A computer program comprising instructions which, when executed by one or more processors, cause the one or more processors to perform a method according to any one of claims 1 to 5.

8. A computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform a method according to any one of claims 1 to 5.

Images