Methods for transferring data from multiple data sources to a data sink

Abstract

According to various embodiments, a method for transferring data from a plurality of data sources (203) to a data sink (205) is described, comprising the steps of: transferring data received from a first data source and transferred from a comparator (204) to the data sink (205) by the monitoring device (206) before the monitoring device (206) receives control information from the comparator (204) indicating the result of a comparison between the data received from the first data source and data received from one or more second data sources among the data sources (203); and notifying the data sink (205) of an error state if, within an error detection time after the data has been transferred to the data sink (205), the monitoring device (206) has not received the control information indicating the result of the comparison from the comparator (204), or if the control information indicates a negative result.

Description

Technical Field

[0001] This disclosure relates to a method for transferring data from multiple data sources to a data sink.

Background Art

[0002] For example, in a technical system in the automotive field, very high requirements are placed on the reliability of its functions (that is, a system that simultaneously places high requirements on the accuracy of the provided data, output or signal, and / or their timely availability). As an example of a system where particularly high reliability is required, there is a "Steer-by-Wire" control system. Usually, in such a system, N redundant data sources (such as functions or data channels) are used, especially to protect data provision and / or data processing regarding error results and failures.

[0003] Depending on the number of redundant data sources, error detection can be performed (in this case, N >= 2), or an error / failure can be temporarily compensated (in this case, N >= 3). In either case, a so-called comparator (English "Voter") that compares the results of the N data sources with each other and determines which data (such as output or signal) is considered accurate and transfers it to the data sink is typically used.

[0004] However, in some systems where such a method is used, when the comparator is waiting to receive data from all data sources (for example, via all N channels) so that it can perform the comparison, if the data provision from one of the data sources is delayed (for example, because one channel is currently too slow), it may lead to delays.

Summary of the Invention

Problems to be Solved by the Invention

[0005] Therefore, even when high requirements are placed on the reliability of data, a method that can transfer data to the data sink with short delays is desirable. [Means for solving the problem]

[0006] According to various embodiments, a method for (effective) data transfer from multiple data sources to a data sink is provided, comprising the steps of: transferring data received from a first data source and transferred from a comparator to the data sink by the monitoring device before the monitoring device receives control information from the comparator indicating the result of a comparison between the data received from the first data source and data received from one or more second data sources; and notifying the data sink of an error condition (e.g., from the monitoring device) if the monitoring device has not received control information indicating the result of the comparison from the comparator within a (set) error detection time after transferring the received data to the data sink, or if the control information indicates a negative result.

[0007] In the methods described above and in the embodiments described later, the data stream and error detection are clearly separated. This allows the data stream to be protected with virtually no latency using M-out-of-N comparison schemes, etc., without significantly limiting consistency monitoring. The end-to-end latency of a (data processing) cycle is determined by the slowest channel after the comparison results become available during transmission, but the methods described above allow the end-to-end latency of each data processing cycle to be determined by the fastest channel.

[0008] Furthermore, it offers reusability and integration. By separating the comparator (comparison device) and the decision-maker (monitoring device), a common "FIFO (First-In-First-Out) comparator" can be reused for multiple applications. All applications acquire the same control information and integrate unique instances of the decision-maker with application-specific monitoring parameters and error responses.

[0009] The separation of comparators and decisionators, and the separation of data streams and error detection, enables better scalability and aggregation of control information in larger distributed systems with numerous data sources and processing paths (which together form, for example, comparators) through the cascading use of multiple consecutive FIFO comparators. The evaluation of the aggregated control information (from consecutive FIFO comparators) can be performed centrally in a monitoring device provided for the data sink (for example, on the data sink).

[0010] Various examples of implementation are described below. Example 1, as described above, is a method for transferring data from multiple data sources to a data sink.

[0011] Example 2 is the method according to Example 1, comprising the steps of: receiving data from a first data source among the data sources using a comparator; transferring the data received from the first data source by the comparator to a monitoring device before the comparator completes the comparison; performing the comparison using the comparator; and transmitting control information indicating the comparison result from the comparator to the monitoring device.

[0012] By having the comparison device transfer the data to the monitoring device before the comparison is complete, delays can be kept to a minimum. Example 3 is a method according to Example 1 or 2, comprising the steps of: if the monitoring device has not received control information indicating the result of the comparison from the comparator within the error detection time after the received data has been transferred to the data sink, the monitoring device notifies the data sink of a first error state; and if the control information indicates a negative result, the monitoring device notifies the data sink of a second error state.

[0013] The data sink can then react differently depending on whether the transferred data was erroneous (indicated by a negative comparison result, i.e., a lack of match between the data received from the data source) or whether the data could not yet be authenticated (i.e., the error detection time has elapsed).

[0014] Example 4 is the method described in one of Examples 1 to 3, and the comparison is an M-out-of-N comparison. Therefore, if data from fewer than M data sources (from the same processing cycle) match, the comparison result will be negative. By selecting M and N, the desired safety can be achieved.

[0015] Example 5 is a method according to any one of Examples 1 to 3, comprising the steps of: performing a transfer of data received from a data source for each of a plurality of processing cycles; and further triggering a reconstruction for a data source received from a comparator with a delay exceeding a delay threshold, which is the number of processing cycles in which each comparison indicates that there is an error in the data from the data source.

[0016] For example, if the data from the data source repeatedly contains errors, or if the reception of data from the data source is repeatedly very slow, making it impossible to transfer the comparison results to the monitoring device within the error detection time, or to use them for comparisons that should have been transferred, a reconfiguration (e.g., migrating the software implementing the data source to different hardware or a different orchestration means) may be performed.

[0017] For this reason, when an error condition is reported, it may be intended that information about the data source where the error is occurring (producing slow results or results that differ from the majority) is also transmitted.

[0018] Example 6 is a data processing apparatus configured to execute the method described in one of Examples 1 to 5. In some cases, the communication system may include only the monitoring device, or the monitoring device, the comparison device and / or the data sink, that is, the data processing apparatus may be only the communication system or a part thereof.

[0019] Example 7 is a computer program that, when executed by one or more processors, includes instructions to cause the one or more processors to execute the method described in any one of Examples 1 to 5.

[0020] Example 8 is a computer-readable medium that stores instructions to cause one or more processors to execute the method described in any one of Examples 1 to 5 when executed by the one or more processors. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] A plurality of examples are detailed below. In the drawings, like reference numerals generally refer to the same parts in all different figures. The drawings are not necessarily to scale; instead, emphasis is generally placed on showing the principles of the present invention. In the following description, various aspects are described with reference to the following drawings. [Figure 1] A communication system. [Figure 2] A communication system according to an embodiment. [Figure 3] A flowchart showing a method for transferring data from a plurality of data sources to a data sink according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0022] The following detailed description refers to the accompanying drawings that show specific details and aspects of the disclosure in which the invention may be implemented for purposes of illustration. Without departing from the scope of protection of the present invention, other aspects may be utilized and structural, logical, and electrical changes may be made. Since various aspects of the present disclosure can be combined with one or more other aspects of the present disclosure to form new aspects, the various aspects of the present disclosure are not necessarily mutually exclusive.

[0023] The process of making decisions is a problem known in information science in a distributed fault-tolerant computing system or a system attempting to reach an agreement on individual data values. The algorithms for solving this problem are known as consensus algorithms. The fields of use of such algorithms are usually large-scale distributed applications operating in data centers. Examples of known algorithms include the Paxos algorithm and the Raft algorithm. Both algorithms are based on the principle of being determined by a majority vote. If this is impossible, a so-called master node makes the final decision. However, such a method requires a certain degree of two-way communication between the participating nodes, resulting in additional latency compared to the processing chain. Due to such characteristics, it is rare to use such algorithms in the context of real-time systems with strict latency requirements. Instead, as described below with reference to FIG. 1, the M-out-of-N method is used in such cases.

[0024] FIG. 1 shows a communication system (or a processing system, hereinafter also simply referred to as a "system") 100. The receiver 101 receives data from multiple data sources, each data source being formed by a single data generator 102 (e.g., a sensor) that transmits data via multiple channels 103 (i.e., each of the multiple data sources corresponds to a combination of the data generator 102 and its respective channel). However, the data sources may also be individual data generators (e.g., individual sensors), each connected to the receiver 101 via the channels 103. The data generator 102 may itself be an input (e.g., a receiver).

[0025] The receiver 101 includes a comparator 104, which compares the data received from the data source (i.e., via the channel in this example) with each other and, if there is sufficient match, forwards them to the data sink 105 (e.g., a control unit, such as a vehicle control unit (ECU) that controls actuators such as brakes for ABS (anti-lock braking system) or ESP (electronic stability program)). Here, sufficient match means, for example, an M-out-of-N match, i.e., a match of (at least) M data packets out of N received data packets, where the data packets correspond to each other, i.e., belong to the same (data) processing cycle, and for example have the same sequence number from the data stream (e.g., for the same data processing cycle out of a series of data processing cycles, e.g., a control cycle).

[0026] In other words, the communication system 100 implements, for example, a so-called M-out-of-N comparison scheme. Data from N channels (e.g., sensor outputs or other signals) is typically provided for each cycle in which new data is provided in a (communication) system where high safety integrity is required. For example, in a 50ms control interval, the received data is compared at the same interval to directly determine whether the system is operating without errors, or whether there are errors and, in some cases, whether the data must be discarded.

[0027] Such M-out-of-N comparison schemes are typically used in (safety-related) real-time systems that have only spatially close, usually locally networked, and tightly synchronized (usually embedded) system components. Such systems, composed of locally networked components, are typically well time-synchronized with each other, for example, through global time (within the local system), where all system components synchronize periodically. This makes it possible to maintain time-synchronized execution of data processing steps between N channels 103 and the subsequent comparators 104. Due to the strict time synchronization, the comparators can process the comparison with virtually no delay in each data processing cycle. Therefore, data provision to the data sink 105 in such a local network system is performed with very little additional latency compared to the processing chain in a single-channel system without redundancy and comparators.

[0028] In a widely distributed system where components are networked, for example, via the internet or other publicly shared networks (e.g., mobile communication networks) (i.e., channel 103 is provided by such a network), it is significantly more difficult to implement an M-out-of comparison scheme to guarantee reliability requirements (regarding data integrity and timely availability) compared to a system with faster (e.g., locally) networked components, due to the following differences:

[0029] 1) There is generally no accurate common time base between components. (2) Therefore, it is difficult to establish and maintain an accurate common time base in sync.

[0030] 2) In packet-based, dynamically routed network communications, the transmission time of individual message / data packets can vary significantly. For example, when the network is highly uptime, packet arrival may be significantly slower (or may not arrive at all) than when the network is less uptime or average.

[0031] 3) If there are defects or temporary failures in the transmission path, communication failures and delays may occur between individual components of the system. Wireless connections (e.g., V2X communication channels) are generally more susceptible to failures than wired connections.

[0032] When an M-out-of-N scheme, as illustrated with reference to Figure 1, is used in a widely distributed networked system where high data integrity (i.e., error-prone content is detected quickly enough) and timeliness of data (e.g., the latest data every 20ms cycle) are simultaneously required, it becomes a 2-out-of-3 scheme, as summarized in Table 1, and presents the following difficulties: For each processing cycle, it is noted which data is being supplied most recently from each channel (this data and the latest data are delayed and may therefore be data from a preceding processing cycle).

[0033] [Table 1]

[0034] Case 1 (Waiting for data for comparison): If comparator 104 waits for all data / signal / output inputs for N channels in cycle z1 to guarantee cycle integrity, in a widely distributed system, there is a non-negligible probability that one of the three characteristics mentioned above will cause a delay in providing results in at least one of the N channels, violating the real-time requirement (i.e., z1 exceeds its maximum allowable time window). This is shown in the z1 column of Table 1 as an example of a 3-out-of-3 comparison.

[0035] Case 2 (Direct Transfer): If a time-optimized "First-In-First-Out" operation is selected (i.e., comparator 104 compares only the data available at the present time and transfers the data without checking it if it cannot be refuted in a timely manner), there is a risk that erroneous data will be received at the data sink and become unidentifiable as an error. Such cases are shown, for example, in columns z2 and z3 of Table 1.

[0036] In either case, at least one of the requirements (high completeness and timeliness, i.e., low latency) is violated. Furthermore, additional (variable) processing latency is added to the processing chain in the form of latency in the comparator. In favorable case 1, there is a controlled error response, such as turning off or suspending the functionality of data sink 105. In unfavorable case 2, the error is forwarded to data sink 105 without being recognized. This concept is not actually suitable for many applications because case 1 is often expected in widely distributed network systems. One reason for this is a potential network problem that may in some cases directly affect system operation and lead to frequent degradation of data sink 105.

[0037] According to various embodiments, a method is provided that enables the implementation of timely and secure applications even in geographically dispersed and networked systems (wireless in the most difficult cases). To this end, a method is provided that enables the use of an M-out-of-N comparison scheme in a distributed system without excessively limiting the achievable requirements with respect to integrity and / or timely reception of data / signals (i.e., low latency), as described below. To this end, according to various embodiments, the functions of the comparator 104 are distributed.

[0038] Figure 2 shows a communication system 200 according to one embodiment. Similar to the communication system 100 in Figure 1, the communication system 200 includes a receiver 201, a data generator 202, multiple channels 203, and a data sink 205. As described above with reference to Figure 1, a separate data generator may be provided for each data source.

[0039] Communication system 200 differs from communication system 100 in Figure 1 in that, following the FIFO (First-In-First-Out) comparator 204 (in the receiver 201), a monitoring device 206 (or decision device, hereafter also called a (metadata) watchdog) is provided instead of the comparator 104. The monitoring device 206 is typically geographically close to the data sink 205 and may, for example, be located within the same component (e.g., device) as the data sink 205. On the other hand, the receiver 201 may be located within a separate component.

[0040] The FIFO comparator 204 and monitoring device 206 implement a bipartite M-out-of-N comparison scheme, extended with cycle-related metadata. This takes advantage of the fact that safety-related real-time applications typically have a so-called fault tolerance time interval (FTTI), during which an error propagated within the system between components has not yet caused a dangerous effect. As an example, consider the braking process in the automotive sector. Error-related brake intervention causes only a brief shock to the vehicle for a few milliseconds, impairing driving comfort but not safety. Part of this application-specific fault tolerance time interval (as the error detection time interval, FDTI) is used in an extended comparison scheme for time-delayed error detection, during which (valid) data can be transferred to subsequent system components with virtually no delay.

[0041] For this purpose, the FIFO comparator 204 and the monitoring device 206 have the following functions. - The FIFO comparator (also called a comparator) 204 performs a retrospective M-out-of-N comparison based on metadata (e.g., temporarily stored) about the acquired data, and then transmits the comparison results to the monitoring device 206 in the form of (meta)control information (e.g., via separately transmitted safety metadata signals).

[0042] - The monitoring device 206 monitors data transfer using the control information generated by the FIFO comparator by evaluating the control information and triggering an error response of the data sink 205 (e.g., turning off a selected function) if an error occurs or if there is no positive control information. Furthermore, according to one embodiment, the monitoring device 206 implements an extended error diagnostic means (also based on the control information) to identify, for example, a persistently unreliable channel 203 and, if necessary, automatically restore the desired reliability of the entire system by reconfiguring the unreliable channel at runtime.

[0043] The following describes in detail the functions of the FIFO comparator 204 and the monitoring device (watchdog) 206 according to one embodiment. The FIFO comparator 204 processes all data related to the new cycle in two phases.

[0044] In Phase 1, the FIFO comparator 204 acquires (valid) data (or signal / output) for the most recent comparison cycle. Due to the slight asynchronous nature described above, data from one of the N redundant channels 203 arrives first at the FIFO comparator 204, is not initially checked by the FIFO comparator 204, and is then forwarded to the watchdog 206 (with a slight delay). Once the data is forwarded, the FIFO comparator also adds the following metadata:

[0045] - The channel or application / function number / ID from which the data was received. - A sequence number / ID that identifies that the data belongs to a cycle. In parallel with this, the FIFO comparator 204 internally stores the aforementioned metadata about the transferred data and performs a retrospective comparison of the data in the cycle in phase 2 whenever data (belonging to the same cycle) is received from at least one other channel among the remaining N-1 channels. Here, (if there are no errors), up to N-1 comparisons are performed between the same data in the same cycle, and the (meta)control information is updated with the result of the last comparison. In one embodiment, the control information is transmitted to the decisionator whenever further comparisons of valid data for the cycle are performed (i.e., when data for the processing cycle is received from further data sources). For example, if the FIFO comparator has data for the cycle from at least two of the N channels, and this makes a first comparison (of two of the N channels) possible, then first control information is created and sent to the watchdog. The result of this first comparison is then sent to the watchdog 206, where a decision can be made as to whether confirmation from two channels is already sufficient, or whether confirmation from further channels should be waited for before the data is considered sufficiently authenticated for use in the data sink (i.e., the watchdog 206 can select M channels as appropriate).

[0046] Failures in the (FIFO) comparator 204 and / or transmission of control information can be detected by the watchdog 206 via so-called timeout monitoring. In a modified version in which the FIFO comparator 204 is entirely software-based, an attempt at automatic repair of the FIFO comparator 204 operating with errors can be triggered, for example, by the watchdog 206, and the FIFO comparator software can be migrated to orchestration software, i.e., another implementation platform, for example, by appropriate virtualization technology and configuration commands, and after migration, can resume operation there.

[0047] To prevent the amount of information to be retained regarding already transferred data from increasing over time in the FIFO comparator 204, in one embodiment, old data (e.g., data already transferred more than a configurable number of seconds prior) is deleted after a certain period of time. To prevent unnecessary resources from being occupied in further network communication with the FIFO comparator 204 and the watchdog 206, old data (e.g., data coming from channels where the data arrives at the FIFO comparator too late) may be filtered directly from the data stream by a unique sequence number assigned to each cycle. This sequence number may be set, for example, by the respective data source itself within a range of header fields in the valid data, or by setting appropriate header fields in the underlying transport protocol.

[0048] The (metadata) watchdog 206 operates in two distinct phases. In Phase 1 (information acquisition), the watchdog 206 retrieves new valid data containing the first metadata (i.e., channel number / channel ID, transfer timestamp, data sequence number, etc.) from the FIFO comparator 204 and stores these internally using the local timestamp. Next, it uses the metadata (e.g., sequence number) to check whether this valid data has already been transferred to the data sink 205. If so, the data is discarded. If the valid data is new (i.e., not yet transferred), the valid data is transferred to the data sink 205. Also, for each cycle of transferred valid data (i.e., valid data with its own sequence number / ID), a reverse error detection timer is started. This duration corresponds to the maximum desired error detection time (FDTI) for each application.

[0049] In Phase 2 (authentication and retrospection by viewing control information generated by comparator 204 and indicating the result of retrospective comparison), initiated by the start of the error detection timer, the watchdog waits for further metadata from the FIFO comparator necessary to authenticate or disprove data that has already been transmitted. If such a timer reaches zero before the watchdog 206 receives control information from comparator 204 indicating that valid data can be sufficiently authenticated by receiving further relevant data (e.g., data packets with the same sequence number or ID) from another channel, the watchdog considers the valid data to be erroneous.

[0050] As soon as new control information arrives at Watchdog 206, it checks whether the data already transmitted has been authenticated (at least partially) or, in some cases, refuted.

[0051] Table 2 shows the process in the FIFO comparator 204 for an example where the FIFO comparator 204 receives data from three sources (S1, S2, S3), i.e., N=3.

[0052] Table 3 shows the generation of corresponding (meta)control information by the FIFO comparator 204. Table 4 shows the process in the monitoring device 206 for this example, specifically indicating which data is transferred from the monitoring device 206 to the data sink 205.

[0053] Table 5 shows the evaluation of control information in the watchdog 206 for this example. In this example, the transmission of control information from the comparator 204 to the monitoring device 206 takes 10 ms. This example spans several processing cycles. The sequence number (Sequence No.) indicates each processing cycle of the monitored application.

[0054] In the examples in Tables 2 through 5, a 2-out-of-3 comparison method is used. The maximum error detection time in these examples is 100 ms.

[0055] [Table 2]

[0056] [Table 3]

[0057] [Table 4]

[0058] [Table 5]

[0059] If the control information identifies an error in the data transferred during a processing cycle, the watchdog 206 checks in phase 2 of the processing whether the data already transferred during that processing cycle was based on the channel identified as having the error, or on a channel that was authenticated as being accurate as a data source. The following cases are possible:

[0060] 1) If, during retrospective comparison (or retrospective observation, i.e., retrospective check of relevant control information), the transferred data is found to be accurate (i.e., the result of the M-out-of-N comparison by comparator 204 is positive), the watchdog 206 does not need to take any further action. In Phase 1, any erroneous data was not transferred to data sink 205.

[0061] 2) If, during retrospective comparison, an error is found in the transferred data, (time-limited) error propagation is performed to the data sink 205, and the watchdog 206 notifies the data sink 205 of this. The data sink then triggers an appropriate error response (e.g., a functional limitation) as needed.

[0062] 3) If the cycle-related error detection timer terminates before 1) or 2) occurs, the transferred data is considered potentially erroneous by the watchdog, appropriate notification is given by the watchdog 206, and an appropriate error response is performed at the data sink 205 if necessary.

[0063] The aforementioned mechanism within watchdog 206 ensures that data with errors is always identified as such within the error detection time (FDTI), and the impact of the error can be appropriately stopped by the M-out-of-N comparison scheme described herein without significantly increasing the latency of the data processing chain in the absence of errors.

[0064] In summary, various embodiments provide a method as shown in Figure 3. Figure 3 is a flowchart 300 showing a data transfer method from multiple data sources to a data sink according to one embodiment.

[0065] In 301, the data received from the first data source and transferred from the comparator is transferred by the monitoring device to the data sink before the monitoring device receives control information from the comparator indicating the comparison result between the data received from the first data source and the data received from one or more second data sources.

[0066] In 302, if the monitoring device has not received control information indicating the comparison result from the comparator within the error detection time after transferring the received data to the data sink, or if the control information indicates a negative result, the error condition is notified to the data sink.

[0067] The method in Figure 3 may be performed by one or more computers having one or more data processing units. The term “data processing unit” can be understood as any type of component that enables the processing of data or signals. Data or signals can be processed according to at least one (i.e., one or more) specific functions performed by the data processing unit, for example. A data processing unit may include or consist of analog circuits, digital circuits, logic circuits, microprocessors, microcontrollers, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable gate array (FPGA) integrated circuits, or any combination thereof. Any other method for implementing each of the functions detailed herein can also be understood as a data processing unit or logic circuit. One or more method steps detailed herein may be performed (e.g., implemented) by a data processing unit through one or more specific functions performed by the data processing unit.

[0068] Therefore, according to various embodiments, this method is particularly well implemented in computers. This method can be used in various systems with multiple data sources, particularly in systems where high reliability and / or latency are required. Examples are as follows:

[0069] - Automotive electronic control units (ECUs), such as powertrain controllers, braking systems, and assistance systems. - Fieldbus programmable logic controllers (PLCs), including virtualized versions, in the industrial sector.

[0070] - For example, further control devices in the above-mentioned fields, such as network gateways. One example of an application is a vehicle equipped with an internal sensor and road-mounted (external to the vehicle) sensors via a wireless network as data sources, with a comparator mounted on the vehicle that monitors redundant information from the internal and external sensors according to the presented method.

[0071] A further application example is computer-aided process control of production equipment, in which case the control algorithm is redundantly calculated on multiple different computers to enhance reliability and safety integrity, and the resulting control commands are monitored by a comparator in a special safety control device (a so-called "programmable safety controller") according to the presented method.

Claims

1. A method for transferring data from multiple data sources (203) to a data sink (205), The monitoring device (206) transfers the data received from the first data source and transferred from the comparator (204) to the data sink (205) before the monitoring device (206) receives control information from the comparator (204) indicating the result of comparing the data received from the first data source with the data received from one or more second data sources of the data source (203). If, within the error detection time after transferring the received data to the data sink (205), the monitoring device (206) has not received the control information indicating the comparison result from the comparator (204), or if the control information indicates a negative result, the monitoring device (206) notifies the data sink (205) of the error state; A method of having.

2. The method according to claim 1, comprising the steps of: receiving data from the first data source among the data sources (203) using the comparator (204); transferring the data received from the first data source by the comparator (204) to the monitoring device (206) before the comparator (204) completes the comparison; performing the comparison using the comparator (204); and transmitting the control information indicating the comparison result from the comparator (204) to the monitoring device (206).

3. The method according to claim 1 or 2, comprising the steps of: if the monitoring device (206) has not received control information indicating the result of the comparison from the comparator (204) within the error detection time after the received data has been transferred to the data sink (205), the monitoring device (206) notifies the data sink (205) of a first error state; and if the control information indicates a negative result, the monitoring device (206) notifies the data sink (205) of a second error state.

4. The method according to any one of claims 1 to 3, wherein the comparison is an M-out-of-N comparison.

5. The method according to any one of claims 1 to 4, further comprising the steps of: performing a transfer of data received from the data source (203) for each of a plurality of processing cycles; and triggering a reconstruction for a data source for a number of processing cycles in which each comparison indicates that there is an error in the data from the data source, or for a data source received from the comparator (204) with a delay exceeding a delay threshold.

6. A data processing device configured to perform the method described in any one of claims 1 to 5.

7. A computer program, when executed by one or more processors, includes instructions causing the one or more processors to perform the method described in any one of claims 1 to 5.

8. A computer-readable medium that, when executed by one or more processors, stores instructions causing the one or more processors to perform the method according to any one of claims 1 to 5.

Images