Method and system for performing time synchronization

Abstract

This document describes a method for performing time synchronization between a master clock and multiple slave clocks. The method includes performing forward time synchronization from the master clock to the multiple slave clocks. In addition, the method includes performing reverse time synchronization from the multiple slave clocks to corresponding multiple validator clocks. Further, the method includes verifying the time synchronization between the multiple slave clocks, particularly the time synchronization between the master clock and the multiple slave clocks, based on the multiple validator clocks.

Description

Technical Field

[0001] This document relates to performing time synchronization between different units within a data communication network, particularly between different control units of a vehicle. Background Art

[0002] A vehicle may include different environmental sensors configured to provide sensor data regarding the environment of the vehicle. Control units within the vehicle may utilize and / or fuse sensor data from different environmental sensors to determine an environmental model that indicates the position of objects within the vehicle's environment. The vehicle may then be operated based on the environmental model, for example, in an autonomous driving mode.

[0003] Each of the different environmental sensors typically includes a local clock configured to provide a timestamp to the sensor data captured by the respective environmental sensor. When fusing the sensor data to determine the environmental model, the timestamps of the sensor data provided by different sensors are typically taken into account.

[0004] Differences in the local times indicated by the local clocks of different environmental sensors may result in an inaccurate environmental model and may affect autonomous driving. Additionally, in cases where the different local clocks of sensors are synchronized on the same communication network (e.g., bus media) that includes one or more unreliable components (e.g., switches), such sensor data timing and / or time synchronization errors are typically common cause errors, even when using redundant sensors or different sensor fusion algorithms. Summary of the Invention

[0005] This document relates to the technical problem of achieving time synchronization between different units, particularly between different sensors and / or fusion units, with a relatively high level of integrity.

[0006] This technical problem is solved by the independent claims. Preferred examples are specified in the dependent claims.

[0007] According to one aspect, a method for performing time synchronization between a master clock and multiple slave clocks (e.g., 2 or more, or 3 or more, or 5 or more slave clocks) is described. The multiple slave clocks may be associated with multiple sensors (e.g., environmental sensors of a vehicle, particularly environmental sensors of a car or a truck or a bus). Each sensor may be configured to provide a timestamp generated by the respective slave clock to the sensor data. During the fusion of the sensor data, the timestamps of the sensor data may be used to fuse the sensor data related to the same moment, thereby improving the quality of the environmental model generated based on the fused sensor data.

[0008] The method may include performing forward time synchronization from a master clock to a plurality of slave clocks. In particular, the method may include performing forward time synchronization from the master clock to a fusion clock of a fusion unit, where the fusion unit is configured to perform sensor fusion of sensor data provided by a plurality of sensors. Then, forward time synchronization from the master clock to the plurality of slave clocks (of the corresponding plurality of sensors) may be performed via the fusion unit.

[0009] During forward time synchronization, the slave time of the slave clock may be time synchronized with the master time of the master clock and / or with the fusion time of the fusion clock. Forward time synchronization may be performed in an efficient and accurate manner using the PTP (Precision Time Protocol) protocol. Forward time synchronization may be performed over a communication network, particularly over an Ethernet network. The communication may exhibit a relatively low integrity level (e.g., ASIL B or QM).

[0010] The method further includes performing reverse time synchronization from the plurality of slave clocks to a corresponding plurality of validator clocks. The validator clocks may be part of a validator. The validator may include a plurality of time domains for the corresponding plurality of validator clocks. During reverse time synchronization, the slave time of the slave clock may be time synchronized with the validator time of the corresponding validator clock. Reverse time synchronization may be performed using the PTP protocol. Additionally, reverse time synchronization may be performed over a communication network, particularly over an Ethernet network.

[0011] The validator including the plurality of validator clocks may have a higher integrity level, particularly a higher ASIL level, than at least one or more components of the communication network, particularly a switch. In particular, the validator may exhibit ASIL D.

[0012] Furthermore, the method includes verifying the time synchronization between the plurality of slave clocks based on the plurality of validator clocks, particularly the time synchronization between the master clock and the plurality of slave clocks. Verifying the plurality of slave clocks may include comparing the validator times of the plurality of validator clocks with each other. In particular, if the validator times of the plurality of validator clocks are time synchronized (e.g., equal to each other), then the plurality of slave clocks may be verified. On the other hand, if the validator times of at least two of the plurality of validator clocks are not time synchronized, then it may be determined that the plurality of slave clocks are not time synchronized (and thus not verified).

[0013] Thus, efficient and reliable time synchronization between different sensors of a vehicle can be achieved. In particular, the integrity of the timestamps of the sensor data of different sensors of the vehicle can be increased, thereby increasing the integrity of the environmental model and / or the integrity of the autonomous driving mode of the vehicle.

[0014] The method may further include performing reverse time synchronization from the fusion clock of the fusion unit to the corresponding validator clock (of the validator). In other words, the validator may further include a validator clock for the fusion clock. By doing so, it can be verified whether the fusion clock is time-synchronized with the plurality of slave clocks (of the corresponding plurality of sensors), thereby improving the quality and / or integrity of sensor fusion.

[0015] As described above, the forward time synchronization and / or the reverse time synchronization may be performed over an Ethernet network. In this case, the forward time synchronization and the reverse time synchronization may use different EtherTypes, thereby allowing a clear separation of the forward time synchronization from the reverse time synchronization to increase the reliability of the time synchronization.

[0016] Compared with the message for forward time synchronization, the message for reverse time synchronization may exhibit a higher priority in terms of processing and / or transmission (within the communication network). By doing so, the reliability of the time synchronization verification can be increased.

[0017] The plurality of validator clocks may be implemented in corresponding different time domains of the synchronization time base manager of the AUTOSAR standard. Therefore, a particularly efficient and reliable verification of the time synchronization can be performed.

[0018] It should be noted that the synchronization method outlined herein may use or may conform to a time synchronization standard protocol (in particular, the PTP protocol) without dedicated integrity or security guarantees (neither in the protocol itself nor in its software implementation). Alternatively or additionally, the synchronization method outlined herein may be performed over an Ethernet communication network that typically includes one or more unreliable network elements (e.g., switches) that generally do not include dedicated integrity or security guarantees in the specification and / or in the hardware and software implementation of the network elements. However, the synchronization method outlined herein is capable of achieving time synchronization at a relatively high integrity level (e.g., ASIL D).

[0019] According to another aspect, a software program is described. The software program may be adapted to be executed on a processor and, when executed on the processor, is adapted to perform the method steps outlined in this document.

[0020] According to another aspect, a storage medium is described. The storage medium may include a software program that is adapted to be executed on a processor and, when executed on the processor, is adapted to perform the method steps outlined in this document.

[0021] According to another aspect, a computer program product is described. The computer program may include executable instructions for performing the method steps outlined in this document when executed on a computer.

[0022] According to another aspect, a system for performing time synchronization between a master clock and a plurality of slave clocks is described. The system is configured to perform forward time synchronization from the master clock to the plurality of slave clocks. In addition, the system is configured to perform reverse time synchronization from the plurality of slave clocks to corresponding plurality of validator clocks. Further, the system is configured to verify the time synchronization between the plurality of slave clocks based on the plurality of validator clocks, particularly the time synchronization between the master clock and the plurality of slave clocks.

[0023] It should be noted that the methods and systems including their preferred embodiments outlined in this patent application can be used alone or in combination with other methods and systems disclosed in this document. In addition, all aspects of the methods and systems outlined in this patent application can be combined arbitrarily. In particular, the features of the claims can be combined with each other in any way. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention will be explained below in an exemplary manner with reference to the accompanying drawings, in which

[0025] Figure 1a example components of a vehicle are shown;

[0026] Figure 1b the fusion of sensor data in the case of an environmental sensor with time synchronization is illustrated;

[0027] Figure 1c the fusion of sensor data in the case of an environmental sensor with a time offset is illustrated;

[0028] Figure 2a an example time synchronization system is shown;

[0029] Figure 2b an example time synchronization system with a clock validator is shown; and

[0030] Figure 3 a flowchart of an example method for performing time synchronization is shown. DETAILED DESCRIPTION

[0031] As mentioned above, this document solves the technical problem of performing time synchronization at a high integrity level, particularly at a relatively high ASIL (Automotive Safety Integrity Level) level (e.g., ASIL D). In this context, Figure 1a example components of a vehicle 100 are shown. The vehicle 100 includes different sensors 111, 112 (particularly environmental sensors) configured to capture sensor data. Example sensors 111, 112 are radar sensors, cameras, lidar sensors, ultrasonic sensors, etc.

[0032] The (central) control unit 101 of the vehicle 100 may be configured to perform fusion of sensor data from different sensors 111, 112. In particular, the control unit 101 may be configured to determine an environmental model of the environment of the vehicle 100 based on the fused sensor data. Additionally, the control unit 101 may be configured to operate one or more actuators 103 (e.g., engine, motor, braking system, and / or steering system) of the vehicle 100 according to the environmental model, e.g., in order to provide an autonomous driving mode of the vehicle 100. For example, the autonomous longitudinal control and / or lateral control of the vehicle 100 may be performed based on the fused sensor data.

[0033] Each sensor 111, 112 of the vehicle 100 typically includes a local clock that indicates the local time at the respective sensor 111, 112. The sensor data of the different sensors 111, 112 may be provided with timestamps of the respective local clocks. The quality and / or reliability of the fused sensor data and / or the environmental model typically depends on the time synchronization of the different local clocks. In particular, a time offset between the different local clocks of the different sensors 111, 112 typically results in a reduced quality of the fused sensor data. This is shown in Figure 1b and Figure 1c and shows Figure 1b and Figure 1c shows the vehicle 100 and a static object 120, where the object 120 is located at a distance 121 from the vehicle 100.

[0034] Figure 1b shows a situation of time synchronization of different local clocks. Thus, the position of the vehicle 100 and / or the position of the static object 120 indicated by the sensor data of the different sensors 111, 112 is similar for all different sensors 111, 112. On the other hand, if the local clocks of the different sensors 111, 112 exhibit a time offset relative to each other, the sensor data of the different sensors 111, 112 may indicate different positions for the vehicle 100 and / or different positions for the static object 120.

[0035] Figure 2a shows an example system 200 for synchronizing the local times or local clocks 213, 214 of different units 203, 204 within the vehicle 100. The system 200 may include a plurality of sensor units 204 for the corresponding plurality of sensors 111, 112 of the vehicle 100. Each sensor unit 204 may include a local clock 214 configured to indicate the local time. Additionally, the system 200 may include a fusion unit 203 configured to fuse and / or combine the sensor data provided by the plurality of sensor units 204 (i.e., sensors 111, 112). The fusion unit 203 may include a local clock 213 configured to indicate the local time.

[0036] The different units 203, 204 can be interconnected via a communication network, in particular an Ethernet network, comprising one or more switches 202. Furthermore, the synchronization system 200 includes a master unit 201, which includes a master clock 211 configured to indicate the local time at the master unit 201 (also referred to herein as the master time).

[0037] The master unit 201 can be configured to perform time synchronization with the fusion unit 203 and with a plurality of sensor units 204. For this purpose, the PTP (Precision Time Protocol) protocol (specified in IEEE 1588) can be used.

[0038] Due to the fact that at least some components in the communication network typically exhibit a relatively low integrity level (in particular a relatively low ASIL level or only QM (Quality Management)), the integrity of the time synchronization is relatively low. As a result, the timestamps of the sensor data of the different sensors 111, 112 exhibit a relatively low integrity level.

[0039] The distribution of the master time from the master clock 211 to the slave entities 203, 204 or to the slave clocks 213, 214 can be regarded as forward time synchronization 231. As described above, the PTP protocol can be used for this forward time synchronization 231.

[0040] The system 200 can include a validator 220, as Figure 2b shown. The validator 220 can include a plurality of time domains 221 with a corresponding plurality of validator clocks 222. The validator 220 can exhibit a relatively high integrity level (e.g., ASIL D). The system 200 can be configured to perform backward or reverse time synchronization 232, during which each of the slave clocks 213, 214 and the master clock 211 is time synchronized with a corresponding validator clock among the validator clocks 222. The backward or reverse time synchronization 232 can be performed using the PTP protocol.

[0041] As a result of the backward time synchronization 232, the validator 220 can access each of the slave clocks 213, 214 within the system 200 and / or access the master clock 211. In particular, the validator 220 includes a plurality of validator clocks 222 that are time synchronized with the corresponding plurality of slave clocks 213, 214. Furthermore, the validator 220 can include a validator clock 222 that is time synchronized with the master clock 211.

[0042] The validator 220 can be configured to compare different times or timestamps indicated by different validator clocks 222. In particular, the validator 220 can be configured to verify whether the different times indicated by different validator clocks 222 are synchronized. If the different times are synchronized, it can be asserted with a relatively high integrity level (e.g., at ASIL D) that the slave clocks 213, 214 of the system 200 are synchronized with each other in time and / or synchronized with the master clock 211 in time. Thus, it can be ensured with a high integrity level that the timestamps of the sensor data of different sensors 111, 112 are synchronized in time.

[0043] The validator 220 can be implemented as a synchronization time base manager of the AUTOSAR standard in an efficient manner. In particular, multiple time domains 221 of the synchronization time base manager can be used to provide different validator clocks 222.

[0044] The validator 220 can form a combined unit with the fusion unit 203. Thus, there is no need to perform backward or reverse synchronization 232 with the master clock 211.

[0045] Therefore, the forward synchronization and reverse synchronization between the master clock 211 and the slave clocks 213, 214 can be performed according to the PTP protocol and according to the AUTOSAR standard (using multiple time domains 221). The time corruption and clock synchronization of the timestamps generated by different time domains 221 can be monitored.

[0046] In addition, jitter detection according to the safety integrity level ASIL D can be performed by the validator 220. The time monitoring unit (i.e., the validator 220) can be implemented in a single node or in multiple overlapping distributed nodes.

[0047] For forward and reverse synchronization, the PTP protocol can use different Ethernet types for forward TSync messages and reverse TSync messages. By doing so, correct time synchronization can be ensured within the Ethernet switch 202 because the Ethernet switch will only perform timestamping for forward TSync messages (as specified in the PTP protocol).

[0048] Figure 3 A flowchart of an example method 300 for performing time synchronization between a master clock 211 (of the master unit 201) and multiple slave clocks 214 (corresponding to multiple slave units 204) is shown. The multiple slave clocks 214 can be associated with corresponding multiple sensors 111, 112.

[0049] Method 300 includes performing 301 a forward time synchronization 231 from a master clock 211 to a plurality of slave clocks 214. The forward time synchronization 231 can be performed via a communication network (in particular via an Ethernet network). The communication network may exhibit (at least in part) a relatively low integrity level (e.g., QM), which may result in a situation where at least one of the slave clocks 214 is not time synchronized with the master clock 211.

[0050] Method 300 further includes performing 302 a reverse time synchronization 232 from the plurality of slave clocks 214 to a corresponding plurality of validator clocks 222 (e.g., via a communication network). The validator clocks 222 can be part of a validator 220, where the validator 220 can exhibit a relatively high integrity level (e.g., ASIL D).

[0051] In addition, method 300 includes validating 303 the time synchronization between the plurality of slave clocks 214 based on the plurality of validator clocks 222, in particular the time synchronization between the master clock 211 and the plurality of slave clocks 214. To this end, the validator times provided by different validator clocks 222 can be compared. If the validator times are equal and / or the time synchronization is present, it can be determined with a relatively high integrity level (e.g., ASIL D) that the plurality of slave clocks 214 are time synchronized.

[0052] The synchronization scheme described herein can ensure time synchronization with a safety integrity level of ASIL D, regardless of the safety integrity level of the Ethernet switch 202 within the communication network. In addition, the synchronization scheme described herein can ensure time synchronization with a safety integrity level of ASIL D, regardless of the safety integrity level of the master clock 211.

[0053] It should be noted that the description and the drawings merely illustrate the principles of the proposed method and system. Those skilled in the art will be able to implement various arrangements, which, although not explicitly described or shown herein, embody the principles of the invention and are included within its spirit and scope. In addition, all examples and embodiments outlined in this document are mainly and explicitly intended solely for illustrative purposes to assist the reader in understanding the principles of the proposed method and system. Moreover, all statements providing the principles, aspects, and embodiments of the invention as well as specific examples thereof are intended to cover their equivalents.

Claims

1. A method (300) for performing time synchronization between a master clock (211) and a plurality of slave clocks (214), wherein the method (300) comprises: - Performing (301) forward time synchronization (231) to synchronize the respective slave clock times of the plurality of slave clocks (214) to the master clock time of the master clock; - Performing (302) reverse time synchronization (232) to synchronize the validator clock times to the slave clock times of the corresponding slave clocks of the plurality of slave clocks for each validator clock among a plurality of validator clocks (222); And - Verifying (303) the time synchronization between the plurality of slave clocks (214) by comparing the validator clock times of the plurality of validator clocks (222).

2. The method (300) according to any one of the preceding claims, wherein the forward time synchronization (231) and / or the reverse time synchronization (232) is performed using the PTP protocol.

3. The method (300) according to any one of the preceding claims, wherein - The forward time synchronization (231) and / or the reverse time synchronization (232) is performed on an Ethernet communication network; and - The forward time synchronization (231) and the reverse time synchronization (232) use different Ethernet types.

4. The method (300) according to any one of the preceding claims, wherein the messages for the reverse time synchronization (232) have a higher priority than the messages for the forward time synchronization (231) in terms of processing and / or transmission.

5. The method (300) according to any one of the preceding claims, wherein - The forward time synchronization (231) and / or the reverse time synchronization (232) is performed on a communication network; and - A validator (220) including the plurality of validator clocks (222) has a higher integrity level than at least one or more components (202) of the communication network.

6. The method (300) according to claim 5, wherein the higher integrity level is a higher ASIL level.

7. The method (300) according to any one of the preceding claims, wherein the plurality of validator clocks (222) are implemented in corresponding multiple different time domains (221) of a synchronization time base manager of the AUTOSAR standard.

8. The method (300) according to any one of the preceding claims, wherein verifying (303) the time synchronization between the plurality of slave clocks (214) comprises: - Comparing the validator times of the plurality of validator clocks (222); - When the validator times of the plurality of validator clocks (222) are operationally equal, determining that the plurality of slave clocks (214) are time synchronized; And / or - When the validator times of at least two of the plurality of validator clocks (222) are operationally unequal, determining that the plurality of slave clocks (214) are not time synchronized.

9. The method (300) according to any one of the preceding claims, wherein - The plurality of slave clocks (214) are associated with a plurality of sensors (111, 112); and - Each of the sensors (111, 112) is configured to provide a timestamp generated by a corresponding one of the slave clocks (214) for sensor data.

10. The method (300) according to claim 9, wherein - The method (300) includes performing (301) a forward time synchronization (231) to synchronize the fusion clock time of a fusion clock (213) to the master clock time of the master clock, wherein the fusion clock is part of a fusion unit (203) configured to perform sensor fusion on the sensor data provided by the plurality of sensors (111, 112); - The forward time synchronization (231) of the slave clocks (214) is performed via the fusion unit (203); and - The method (300) includes performing a reverse time synchronization (232) to synchronize the validator clock time of a corresponding validator clock (222) to the fusion clock time of the fusion clock.

11. A system (200) for performing time synchronization between a master clock (211) and a plurality of slave clocks (214), wherein the system (200) is configured to, - Perform a forward time synchronization (231) to synchronize the respective slave clock times of the plurality of slave clocks (214) to the master clock time of the master clock; - Perform a reverse time synchronization (232) to synchronize the validator clock time to the slave clock time of a corresponding slave clock of the plurality of slave clocks for each validator clock among a plurality of validator clocks (222); and - Verify the time synchronization between the plurality of slave clocks (214) by comparing the validator clock times of the plurality of validator clocks (222).

Images