Method and apparatus for ensuring integrity of transmitted data in a distributed control system

An electronic control system has a plurality of mutually networked or communicating control units, with special, redundant safeguarding measures during transmission of a safety-related transmitted signal from a first control unit to a second control unit. The first control unit generates the transmitted signal and a second signal complementary thereto on different paths, and sends them to a memory, together with two additional signals which are significant for the paths. A third control unit reads out the transmitted signal and the second signal from the memory, and checks them, and, upon detection of an error, switches off the first control unit or, given correct signals, generates different types of test or safety signals and conducts them to a memory. The first control unit reads out the test or safety signals from the last-named memory and checks them and, upon detection of an error, switches itself off, or, given correct test or safety signals, feeds the transmitted signal and at least one prescribed selection of the test or safety signals to the second control unit.