Method and device for monitoring control units

A method of monitoring at least one of data and transmission of data between a first control unit and a second control unit, the two control units having a first program level, to which are allocated programs which calculate a control function, as well as a second program level including programs that monitor functional reliability of the programs of the first program level, the first control unit being connected to at least one component which is used to acquire data, comprising the steps of:

• transmitting at least one of the data acquired by the component and data derived from the data acquired by the component, from the first control unit to the second control unit over a single connection in a secure manner;
• separating, in a secure manner, the at least one of the data and the data transmission in the first and second program levels such that errors in the at least one of the data and the data transmission are detected;
• and
• providing an error response, by which a more secure state is set in the second controller, when an error in the at least one of the data and the data transmission is detected.

A device for monitoring at least one of data and transmission of data, comprising:

• first and second control units, the control units including a first program level, to which are allocated programs which calculate a control function, as well as a second program level including programs that monitor functional reliability of the programs of the first program level;
• a component for acquiring data, which component is connected to the first control unit, wherein at least one of the data acquired by the component and data derived from the data acquired by the component are transmitted from the first control unit to the second control unit over a single connection in a secure manner;
• and
• an arrangement which implements separate security for the at least one of the data and the data transmission in the first and second program levels such that errors in the at least one of the data and the data transmission are detected;
• wherein a second signal path, other than a first signal path of the first program level, is provided for monitoring in the second program level to protect data.