Verification of Time Synchronization

Abstract

A method for time synchronization verification of at least two controllers connected to each other via a private communication bus is provided, where one of the at least two controllers is a master device controller and the other of the at least two controllers is a slave device controller. The method includes a plurality of cycles, where each cycle includes sending a subsequent message from the master device controller to the slave device controller in response to the pulling of a predefined pin of the master device controller, where the subsequent message includes the global time of the master device controller when the predefined pin is pulled, sending a verification message from the slave device controller to the master device controller in response to the received subsequent message, where the verification message includes the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin, and verifying the time synchronization by checking at the master device controller and / or the slave device controller whether the difference between the global time of the master device controller when the predefined pin is pulled and the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin is less than a predefined first threshold.

Description

[0001] The present invention relates to a method for verifying the time synchronization of at least two controllers connected to each other via a private bus, a master device controller configured to be connected to a slave device controller via a private bus and at least partially execute the method, a slave device controller configured to be connected to the master device controller via a private bus and at least partially execute the method, a communication network including the master device controller and the slave device controller, and a vehicle including the communication network, such as an automobile.

[0002] As the complexity of autonomous or automated vehicles increases, different electronic control units (ECUs) use multiple communication buses to ensure that autonomous or automated driving functions meet safety requirements, such as the requirements needed to meet the so-called Automotive Safety Integrity Level (ASIL).

[0003] The Automotive Safety Integrity Level is a risk classification scheme defined by ISO 26262 - Functional Safety of Road Vehicles. The ASIL classification includes five safety levels, from QM with the lowest safety requirements to ASIL D with the highest safety requirements.

[0004] All relevant controllers involved in key decisions of autonomous driving functions need to have a synchronized time according to other controllers. The time synchronization of highly automated vehicles needs to meet ASIL D, such as vehicles of SAE level 3 or 4 or higher (where the SAE J3016 standard describes the classification and definition of terms for road vehicles with autonomous driving systems).

[0005] In the prior art, the time synchronization of Ethernet buses is done according to IEEE802.1AS for TSN (Time Sensitive Network) and IEEE 1588 for PTP (Precision Time Protocol). However, for time synchronization via PTP, in addition to the corresponding standards, several measures can be taken, so that the integrity of the synchronization process can be ensured, and thus the integrity of the distributed time-based can be ensured.

[0006] However, if the controllers are connected to each other via a private bus system (such as PCI Express, CAN-FD, MIPI, SERDES, SPI, etc.), the PTP implementation for time synchronization is not available.

[0007] According to the prior art, the object of the present invention is to provide a solution for verifying the time synchronization of at least two controllers connected to each other via a private bus, wherein it is ensured that a predetermined safety integrity level, such as ASIL B or higher, is met.

[0008] This object is solved by the features of the independent claims. The dependent claims contain preferred further developments of the invention.

[0009] More specifically, this object is solved by a method for verifying the time synchronization of at least two controllers connected to each other via a private bus, wherein one of the at least two controllers is a master device controller and the other of the at least two controllers is a slave device controller.

[0010] The method includes a plurality of cycles. Each cycle includes sending a subsequent message from the master device controller to the slave device controller in response to the pulling of a predefined pin of the master device controller, wherein the subsequent message includes the global time of the master device controller when the predefined pin is pulled.

[0011] Each cycle further includes sending a verification message from the slave device controller to the master device controller in response to the received subsequent message, wherein the verification message includes the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin.

[0012] Each cycle (except for the initial / first cycle) further includes verifying the time synchronization by checking at the master device controller and / or the slave device controller whether the difference between the global time of the master device controller when the predefined pin is pulled and the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin is less than a predefined first threshold. A prerequisite for this can be that the synchronized global time at the master device controller has been verified.

[0013] The method may include capturing at the master device controller the global time of the master device controller when the predefined pin is pulled.

[0014] The verification message may include the local hardware counter of the slave device controller, wherein the local hardware counter corresponds to the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin.

[0015] The local hardware counter of the slave device controller is a second time source enabling the master device controller and / or the slave device controller to perform the following checks.

[0016] That is to say, verifying the time synchronization may further include checking at the master device controller the difference between the global time captured by the master device controller when the predefined pin is pulled and the global time captured by the master device controller when the predefined pin was pulled in the previous cycle, and the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pulling of the predefined pin in the previous cycle, and whether the difference is less than a predefined second threshold. This verification is not performed in the initial / first cycle of the method.

[0017] Additionally or alternatively, verifying time synchronization can include checking at the slave device controller the difference between the global time of the master device controller received by the slave device controller in a subsequent message and the global time of the master device controller received by the slave device controller in a subsequent message in a previous cycle, and whether the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pulling of a predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pulling of the predefined pin in a previous cycle is less than a predefined second threshold.

[0018] The verification message can include the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pulling of a predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pulling of the predefined pin in a previous cycle. That is, the verification message can already include the difference between the hardware counters, where the difference is calculated by the slave device controller.

[0019] The master device controller can be connected to an additional bus. The additional bus can also be referred to as the main bus.

[0020] The master device controller can include a master device port and a slave device port, where the master device controller is connected to the additional bus via its slave device port. The slave device port and the master device port can each include their own clocks.

[0021] The method can include synchronizing the global time of the clock of the slave device port of the master device controller with the global time of the additional bus, and preferably, after synchronizing the global time of the clock of the slave device port with the global time of the additional bus, synchronizing the global time of the clock of the master device port of the master device controller with the global time of the clock of the slave device port of the master device controller.

[0022] The method can further include capturing at the master device controller the global time of the slave device port when a predefined pin is pulled. Moreover, this is preferably done after synchronizing the global time of the clock of the slave device port with the global time of the additional bus.

[0023] For the above reasons, the master device controller can perform the following checks. That is, verifying time synchronization can include checking at the master device controller whether the difference between the global time captured by the master device controller at the master device port (i.e., the global time of the clock of the master device port of the master device controller when a predefined pin is pulled) and the global time captured by the master device controller at the slave device port (i.e., the global time of the clock of the slave device port of the master device controller when the predefined pin is pulled) is less than a predefined third threshold.

[0024] The method may include, preferably after capturing the local hardware counter and after the global time of the slave device controller when a predefined pin is detected to be pulled by the slave device controller, updating the global time of the slave device controller to the global time of the master device controller included in a subsequent message.

[0025] The verification message may include the global time sent from the master device controller to the slave device controller in a subsequent message. Thus, verifying time synchronization may include checking, at the master device controller, whether the difference between the global time captured by the master device controller when the predefined pin is pulled and the global time included in the verification message is less than a predefined fourth threshold.

[0026] Furthermore, a master device controller is provided, wherein the master device controller is configured to be connected to a slave device controller via a private bus.

[0027] The master device controller is further configured to, in response to the pulling of a predefined pin of the master device controller and record (i.e., capture) the time when the pin is pulled, send a subsequent message to the slave device controller via the private bus, wherein the subsequent message includes the global time of the master device controller when the predefined pin is pulled.

[0028] The master device controller is further configured to receive a verification message from the slave device controller via the private bus in response to the sent subsequent message, wherein the verification message includes the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin.

[0029] The master device controller is further configured to verify the time synchronization between the global time of the slave device controller and the global time of the master device controller by checking whether the difference between the global time of the master device controller when the predefined pin is pulled and the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin is less than a predefined first threshold.

[0030] The verification message may include the local hardware counter of the slave device controller as a second time source, wherein the local hardware counter corresponds to the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin.

[0031] The master device controller may be configured to capture the global time of the master device controller when the predefined pin is pulled, i.e., the master device controller may include at least one clock, and capture the time of the clock when the predefined pin is pulled by the master device controller.

[0032] The master device controller can be configured to verify the time synchronization of the global time of the slave device controller with the global time of the master device controller by checking the difference between the global time captured by the master device controller when a predefined pin is pulled and the global time captured by the master device controller when the predefined pin was pulled in the previous cycle, and that the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pulling of the predefined pin in the previous cycle is less than a predefined second threshold.

[0033] The verification message can include the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pulling of the predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pulling of the predefined pin in the previous cycle.

[0034] The master device controller can be configured to connect to another bus and synchronize its global time with the global time of the other bus.

[0035] More specifically, the master device controller can include a master device port and a slave device port, where each of the slave device port and the master device port includes a clock. The master device controller can be connected to another bus, such as the main bus of a vehicle, via its slave device port and is configured to synchronize the global time of the clock of the slave device port to the global time of the other bus. This can be done by using PTP. Preferably, afterwards, the master device controller synchronizes the global time of the clock of the master device port with the global time of the clock of the slave device port of the master device controller and captures the global time of the slave device port when the predefined pin is pulled.

[0036] The master device controller can be configured to verify the time synchronization of the global time of the clock of its slave device port with the global time of the clock of its master device port by checking whether the difference between the global time of the clock of its master device port (preferably captured when the predefined pin is pulled) and the global time of the clock of its slave device port (also preferably captured when the predefined pin is pulled) is less than a predefined third threshold.

[0037] This verification enables the master device controller to check whether the difference between its internal clocks is within an acceptable range.

[0038] In addition, a slave device controller is provided, where the slave device controller is configured to be connected to the master device controller via a private bus.

[0039] The slave device controller is further configured to receive a subsequent message from the master device controller via a private bus in response to a pull of a predefined pin of the master device controller, wherein the subsequent message includes the global time of the master device controller when the predefined pin is pulled.

[0040] The slave device controller is further configured to detect a pull of a predefined pin of the master device controller and capture the global time of the slave device controller when the slave device controller detects the pull of the predefined pin.

[0041] The slave device controller is further configured to verify time synchronization by checking whether the difference between the global time of the master device controller included in the subsequent message and the global time captured by the slave device controller when the slave device controller detects the pull of the predefined pin (i.e., the global time of the clock of the slave device controller when the pull of the predefined pin is detected at the slave device controller) is less than a predefined first threshold.

[0042] The slave device controller may be configured to send a verification message to the master device controller via the private bus in response to the received subsequent message.

[0043] The verification message may include the global time of the slave device controller when the slave device controller detects the pull of the predefined pin, such that the master device controller can verify time synchronization by checking whether the difference between the global time of the master device controller when the predefined pin is pulled at the master device controller and the global time of the slave device controller when the slave device controller detects the pull of the predefined pin is less than a predefined first threshold at the master device controller. The verification message may further include the global time of the master device controller included in the subsequent message.

[0044] The slave device controller may be configured to capture the local hardware counter of the slave device controller, wherein the local hardware counter corresponds to the global time of the slave device controller when the slave device controller detects the pull of the predefined pin.

[0045] The slave device controller may be configured to verify the time synchronization between the global time of the slave device controller and the global time of the master device controller by checking that the difference between the global time of the master device controller included in the subsequent message and the global time of the master device controller included in the subsequent message in the previous cycle, and the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pull of the predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pull of the predefined pin in the previous cycle is less than a predefined second threshold.

[0046] The slave device controller can be configured to send a verification message including the local hardware counter of the slave device controller and the global time of the master device controller included in a subsequent message, such that the master device controller can verify the time synchronization between the global time of the slave device controller and the global time of the master device controller by checking the difference between the global time of the master device controller included in the verification message and the global time of the master device controller included in the verification message in a previous cycle, and the difference between the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detects the pulling of a predefined pin and the local hardware counter corresponding to the global time of the slave device controller when the slave device controller detected the pulling of the predefined pin in a previous cycle is less than a predefined second threshold. The verification message may include two local hardware counters. It is also possible to include only the difference between the two local hardware counters in the verification message.

[0047] The slave device controller can be configured to update the global time of the slave device controller to the global time of the master device controller included in a subsequent message when the slave device controller detects the pulling of a predefined pin but after capturing the local hardware counter and the global time of the slave device controller.

[0048] Furthermore, a communication network is provided, wherein the communication network may include the above-mentioned master device controller, the above-mentioned slave device controller, and a private communication bus connecting the master device controller and the slave device controller to each other. The private communication bus may include a connection between a predefined pin of the master device controller and the slave device controller.

[0049] The communication network may include an additional communication bus connected to the master device controller, wherein the master device controller is configured to synchronize its global time with the global time of the additional bus.

[0050] Furthermore, a vehicle, such as an automobile, may be provided, wherein the vehicle includes the above-mentioned communication network.

[0051] In short, the basic principle of the present invention is to emulate PTP for time synchronization of controllers.

[0052] Time synchronization verification according to ASIL B or ASIL D can be ensured by different security mechanisms. A controller, such as a microcontroller, can be divided into a master device controller having one or more slave device controllers, wherein the master device controller is connected to any communication bus (such as Ethernet, Flexray, CAN-FD) allowing standard time synchronization. Only the master device controller is connected to an additional bus, i.e., the main bus, so the master device controller and the slave device controller are part of a dedicated network, i.e., an independent network.

[0053] The master device controller may have only one time representation or may have one time synchronization slave port and multiple time synchronization master ports.

[0054] When a predefined pin (e.g., a general-purpose input / output pin (GPIO)) is pulled from the master device controller, the master device controller provides a subsequent message with its global time. The slave device controller may have only a time synchronization slave port.

[0055] A combination of pin pulling or emulated pin pulling and a time synchronization mechanism with subsequent messages may be provided.

[0056] As close as possible to the time point when the pulling of the predefined pin at the master device controller is detected at the slave device controller side, the value of the local hardware counter and its associated global time can be captured.

[0057] The global time at the slave device controller should be captured before the global time on the slave device controller is updated based on the new value received in a subsequent message (i.e., a subsequent message sent from the master device controller to the slave device controller in response to the pulling of the predefined pin).

[0058] After the hardware counter and the global time are captured at the slave device controller, the time synchronization mechanism can use the subsequent message to update the global time on the slave device controller.

[0059] The local hardware counter with the time synchronization mechanism (i.e., GPIO pulling and subsequent messages) can be used to verify the system time at the slave device controller side.

[0060] This concept enables different controllers that can be connected to each other via a communication channel to internally verify their times where standard synchronization and verification mechanisms are not available.

[0061] For time verification, no additional connection between the master device controller and the slave device controller, such as GPIO, is required because a commonly used pin connection for time synchronization can be shared separately between time synchronization and time verification at the master device controller and the slave device controller.

[0062] During the time between any two synchronizations, a verification message can be sent from the slave device controller to the master device controller, i.e., a verification message in response to the received subsequent message.

[0063] The verification message can include the difference of the hardware counter of the slave device controller between two synchronization points, the captured global time of the slave device controller when the pulling of the predefined pin is registered in the current communication cycle, and the global time received within the subsequent message.

[0064] The master device controller can capture the global time written in the subsequent message, and this global time is very close to the time point when the predefined pin is pulled.

[0065] Security / verification checks can be performed on both the master device controller and the slave device controller to include cross-detection on both sides.

[0066] On the slave device side, the difference between the global time captured at the slave device controller at the time point when the predefined pin is pulled and the global time received at the subsequent message should be less than a predefined first threshold.

[0067] On the device side, the difference between the global time written in the subsequent message and the global time received on the slave device side included in the verification message should be less than a predefined first threshold.

[0068] Hereinafter, reference Figure 1 and Figure 2 give a description of embodiments of the present invention.

[0069] Figure 1 Schematically shows a communication network used in a method for verifying time synchronization of at least two controllers connected to each other via a private bus.

[0070] Figure 2 Schematically shows a flowchart of a method for verifying time synchronization of at least two controllers connected to each other via a private bus.

[0071] As Figure 1 shown, the communication network 1 includes a master device controller 2, a slave device controller 3, and a private communication bus 4 that connects the master device controller 2 and the slave device controller 3 to each other.

[0072] The master device controller 2 includes a slave device port 21, and the slave device port 21 is connected to the master device port 51 of the master device controller 5 of another (i.e., additional) communication network. The master device controller 2 also includes a master device port 22, and the master device port 22 is connected to the slave device port 31 of the slave device controller 3 via the private communication bus 4, where these ports 22, 31 are used for the time synchronization of the master device controller 2 and the slave device controller 3 described in detail below Figure 2 regarding.

[0073] Another communication network, i.e., another communication bus (such as Ethernet, Flexray, CAN-FD) allows standard time synchronization, so that the global time of the master device controller 2 is synchronized with the global time of another communication bus, for example, by receiving a time synchronization message including the synchronization time t aS1 from the master device port 51 of the master device controller 5 of another communication network via the slave device port 21 at the master device controller 2.

[0074] More specifically, the master device port 22 and the slave device port 21 each include their own clock. The global time of the clock of the slave device port 21 is synchronized with the global time of another bus, for example by using PTP, and then the global time of the clock of the master device port 22 is synchronized with the synchronized global time of the clock of the slave device port 21.

[0075] The method includes a plurality of cycles, and two cycles are shown in Figure 2 Each cycle starts with the pulling of a predefined pin of the master device controller 2, here the cycle GPIO pull.

[0076] First, that is, after the global time of the master device controller 2 is synchronized with the global time of another bus, the master device controller 2 sends a subsequent message to the slave device port 31 of the slave device controller 3 via the private communication bus 4 in response to the pulling of a predefined pin of the master device controller 2.

[0077] The subsequent message includes the global time t aM1 、t aM2 of the master device controller 2, at which global time t aM1 ,t aM2 the predefined pin is pulled during the actual cycle of the method.

[0078] In response to the subsequent message received at the slave device controller 3, the slave device controller 3 sends a verification message to the master device controller 2 via its slave device port 31 and the communication bus 4.

[0079] The verification message includes the global time t bS1 、t bS2 of the slave device controller 3 when the predefined pin is detected to be pulled by the slave device controller 3 in the actual / current cycle. The master device controller 3 is configured to capture (i.e., save) the received global time t bS1 、t bS2 . The verification message further includes the local hardware counter c bS1 、c bS2 of the slave device controller 3, where the local hardware counter c bS1 、c bS2 corresponds to the global time t bS1 、t bS2 of the slave device controller 3 when the predefined pin is detected to be pulled by the slave device controller 3 in the current cycle.

[0080] Therefore, when the slave device controller 3 detects the pulling of the predefined pin, the slave device controller 3 captures the global time t bS1 、t bS2 of the slave device controller 3 and the local hardware counter c bS1 、cbS2 As shown in Figure 2 hardware counters c bS1 and c bS2 each value is directly linked to the global time t bS1 and t bS2 of the slave device controller 3 at the corresponding cycle, i.e., the synchronization time.

[0081] The slave device controller 3 calculates the local hardware counter c bS2 corresponding to the global time t bS2 of the slave device controller 3 when the slave device controller 3 detects the pulling of a predefined pin in the current cycle bS1 and the local hardware counter c bS1 corresponding to the global time t bS1 of the slave device controller 3 when the slave device controller 3 detected the pulling of a predefined pin in the previous cycle. This difference is sent from the slave device controller 3 to the master device controller 2 in the verification message. The values t bS1 and c bS1 were captured in the previous synchronization cycle. Since it is not possible to calculate this difference in the first cycle of the method (due to the loss of the local hardware counter corresponding to the global time of the slave device controller when the slave device controller 3 detected the pulling of a predefined pin in the previous cycle), this value is set to zero during the first cycle, i.e., in the first verification message.

[0082] After capturing these values t bS1 and c bS1 and t bS2 and c bS2 the slave device controller 3 updates (i.e., synchronizes) its global time to the global time t' aM1 and t' aM2 received from the master device controller 2 in the subsequent message.

[0083] In addition, the slave device controller 3 adds the global time t' aM1 and t' aM2 to the verification message received from the master device controller 2 in the subsequent message, and this time is the time when the global time of the slave device controller 3 is updated. Sending the received global time t' aM1 and t' aM2 back to the master device controller 2 ensures that this value is not tampered with on the communication path (e.g., at the transmit communication stack of the master device controller 2, during transmission on the private bus 4, at the receive communication stack of the slave device controller 3, at the transmit communication stack of the slave device controller 3, and / or at the receive communication stack of the master device controller 2).

[0084] Since the software processing in the slave device controller 3 takes some time, where this delay is inFigure 2 which is represented by Δt in the program and hardware processing, there are also other uncertainties, and the time synchronization of the master device controller 2 and the slave device controller 3 is processed by a standard mechanism that only meets the ASIL QM safety requirements. Therefore, it must be verified, that is, it must be ensured that the difference in the global time between the master device controller 2 and the slave device controller 3 is within a certain range. This can be done according to the safety requirements of ASIL D.

[0085] Verifying the time synchronization includes checking at the master device controller 2 and the slave device controller 3 the global time t' of the master device controller 2 when a predefined pin is pulled during the second cycle aM2 and the global time t of the slave device controller when the slave device controller 3 detects the pulling of the predefined pin during the second cycle bS2 to see if the difference between them is less than a predefined first threshold. Therefore, the master device controller 2 receives the global time t' included in the subsequent message aM2 , as well as the global time t of the slave device controller 3 in the verification message sent from the slave device controller 3 to the master device controller 2 bS2 . In other words, the slave device controller 3 sends the global time t' aM2 back to the master device controller 2 in the verification message.

[0086] This check is performed to ensure that the global time of the master device controller 2 and the global time of the slave device controller 3 are synchronized so that they meet the above safety integrity requirements, such as ASIL D.

[0087] Alternatively or additionally, the master device controller 2 not only sends the global time t' of the master device controller 2 when the predefined pin is pulled aM2 , but also captures and saves the global time t of the master device controller 2 when the predefined pin is pulled aM2 .

[0088] Then, verifying the time synchronization also includes checking at the master device controller 2 the global time t captured by the master device controller 2 during the second cycle aM2 and the global time t captured by the master device controller 2 when the predefined pin was pulled during the first cycle aM1 to see the difference between them, as well as the local hardware counter c received by the master device controller 2 during the second cycle bS2 and the local hardware counter c received by the master device controller 2 during the second cycle and corresponding to the global time t of the slave device controller 3 when the slave device controller 3 detected the pulling of the predefined pin during the first cycle bS1 to see if the difference between the differences is less than a predefined second threshold. bS1

[0089] Thus, it is possible to check the time elapsed between the first cycle and the second cycle on the slave device controller 3 using the counter value (i.e., the difference between the local hardware counter c bS2 -c bS1 and the time difference using the master device port 31 (i.e., t aM2 -t aM1 ) between the first cycle and the second cycle on the master device controller to see if they are synchronized, i.e., within an acceptable range (see above, e.g., ASIL D).

[0090] Verifying time synchronization may also include checking, at the slave device controller 3, the difference between the global time t' received by the slave device controller 3 during the second cycle aM2 and the global time t' received by the slave device controller 3 during the first cycle aM1 , as well as the difference between the local hardware counter c captured by the slave device controller 3 during the second cycle bS2 and the local hardware counter c captured by the slave device controller 3 during the first cycle and corresponding to the global time t of the slave device controller 3 when the slave device controller 3 detected the pulling of a predefined pin during the first cycle bS1 to see if the difference between them is less than a predefined second threshold. bS1 Thus, it is possible to use the counter value to check if the time elapsed between the first cycle and the second cycle on the slave device controller 3 (i.e., the difference between the local hardware counter c

[0091] -c bS2 -c bS1 ) is synchronized with the time elapsed between the first cycle and the second cycle on the master device controller 2 (i.e., t' aM2 -t' aM1 ), i.e., within an acceptable range (see above, e.g., ASIL D).

[0092] It is also possible to check if the time synchronization between the master device port 22 and the slave device port 21 of the master device controller 2 is synchronized, i.e., within an acceptable range (see above, e.g., ASIL D). Thus, verifying time synchronization may include checking, at the master device controller 2, the difference between the global time t captured by the master device controller 2 at the master device port 22 when a predefined pin is pulled during the second cycle aM2 and the global time t captured by the master device controller 2 at the slave device port 21 when a predefined pin is pulled during the second cycle aS2 to see if the difference is less than a predefined third threshold. This check can also be performed starting from the first cycle of the method (t aM1 -t aS1 < third threshold).

[0093] In addition, to ensure the integrity of the communication path of the private bus 4, the master device controller 2 will capture the time t at the master device controller 2 aM2 (when the predefined pin is pulled out and written into the subsequent message of the slave device controller 3) with the global time t' aM2 (which the slave device controller 3 receives in the subsequent message and writes the verification message into the master device controller 2) and compare them, where the difference between these values should be less than the predefined fourth threshold. Since the transmission path of the master device controller 3, the transmission path and the reception path of the slave device controller 3 are only implemented as ASIL QM using the standard Autosar mechanism, t aM2 and t' aM2 may be different. This check can also be performed starting from the first cycle of this method (t' aM1 -t aM1 <the fourth threshold).

[0094] For the master device controller 2, the above check can be summarized as follows:

[0095] t bS2 -t' aM2 <the first threshold

[0096] t aM2 -t aM1 -(c bS2 -c bS1 )<the second threshold

[0097] t aM2 -t aS2 <the third threshold

[0098] t' aM2 -t aM2 <the fourth threshold

[0099] The above check for the slave device controller 3 can be summarized as follows:

[0100] t bS2 -t' aM2 <the first threshold

[0101] t' aM2 -t' aM1 -(c bS2 -c bS1 )<the second threshold

[0102] List of reference numerals

[0103] 1 Communication network

[0104] 2 Master device controller

[0105] 21 Slave port of the master device controller

[0106] 22 Master device port of the master device controller

[0107] 3 Slave device controller

[0108] 31 Slave device port of the slave device controller

[0109] 4 Private communication bus

[0110] 5 Another master device controller of another communication network

[0111] 51 Master device port of the another master device controller

[0112] GPIO General-purpose input / output

[0113] t aM1 ,t aM2 Global time of the clock of the master device port of the master device controller when a predefined pin is pulled during the first / second cycle

[0114] t' aM1 ,t' aM2 Global time of the master device port of the master device controller received by the slave device controller when a predefined pin is pulled during the first / second cycle

[0115] t aS1 ,t aS2 Global time of the slave device port of the master device controller

[0116] c bS1 ,c bS2 Local hardware counter corresponding to the global time t of the slave device controller when the slave device controller detects the pulling of a predefined pin during the first / second cycle bS1 ,t bS2 Global time of the slave device controller when the slave device controller detects the pulling of a predefined pin during the first / second cycle

Claims

1. A method for verifying the time synchronization of at least two controllers connected to each other via a private communication bus (4), wherein one of the at least two controllers is a master device controller (2), and the other of the at least two controllers is a slave device controller (3), the method comprising a plurality of cycles, wherein each cycle comprises: - In response to the pulling of a predefined pin of the master device controller (2), sending a subsequent message from the master device controller (2) to the slave device controller (3), - wherein the subsequent message includes the global time (t') of the master device controller (2) when the predefined pin is pulled aM2 ) - In response to the received subsequent message, sending a verification message from the slave device controller (3) to the master device controller (2), - wherein the verification message includes the global time (t of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin bS2 ), and - By checking, at the master device controller (2) and / or the slave device controller (3), whether the difference between the global time (t' aM2 ) of the master device controller (2) when the predefined pin is pulled and the global time (t bS2 ) of the slave device controller (3) when the pulling of the predefined pin is detected by the slave device controller (3) is less than a predefined first threshold, to verify the time synchronization.

2. The method according to claim 1, - wherein the method includes capturing, at the master device controller (2), the global time (t of the master device controller (2) when the predefined needle is pulled aM2 ) - wherein the verification message includes the local hardware counter (c bS2 ) of the slave device controller (3), and the local hardware counter (c bS2 ) corresponds to the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and - wherein verifying the time synchronization comprises checking at the master device controller (2) whether the difference between the following is less than a predefined second threshold: - The global time (t aM2 ) captured by the master device controller (2) when the predefined needle is pulled, and the global time (t aM1 ) captured by the master device controller (2) when the predefined needle was pulled in the previous cycle, and the difference between them, and - corresponding to the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and the local hardware counter (c bS2 ), and the difference between the local hardware counter (c bS1 ) corresponding to the global time (t bS1 ) of the slave device controller (3) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle, and / or - wherein verifying the time synchronization comprises checking at the slave device controller (3) whether the difference between the following is less than the predefined second threshold: - the difference between the global time (t') of the master device controller (2) received by the slave device controller (3) in the subsequent message and the global time (t') of the master device controller (2) received by the slave device controller (3) in the subsequent message in a previous cycle, and aM2 ) and the global time (t') of the master device controller (2) received by the slave device controller (3) in the subsequent message in a previous cycle aM1 ), and - corresponding to the local hardware counter (c bS1 ) of the slave device controller (3) at the global time (t bS2 ) when the slave device controller (3) detects the pulling of the predefined pin, and the local hardware counter (c bS1 ) of the slave device controller (3) at the global time (t bS1 ) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle.

3. The method according to claim 2, - wherein the verification message includes the local hardware counter (c bS2 ) corresponding to the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and the local hardware counter (c bS1 ) corresponding to the global time (t bS1 ) of the slave device controller (3) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle, and the difference therebetween.

4. The method according to claim 2 or 3, - wherein the master device controller (2) comprises a master device port (22) and a slave device port (21), wherein the master device controller (2) is connected to an additional bus via the slave device port (21), and each of the slave device port (21) and the master device port (22) comprises a clock, and - wherein the method comprises: - Synchronizing the global time of the clock of the slave device port (21) of the master device controller (2) with the global time of the additional bus, - Synchronizing the global time of the clock of the master device port (22) of the master device controller (2) with the global time of the clock of the slave device port (21) of the master device controller (2), and - Capture, at the master device controller (2), the global time (t aS2 ) of the slave device port (21) when the predefined pin is pulled - wherein verifying the time synchronization includes checking at the master device controller (2) the global time (t aM2 ) captured at the master device port (22) by the master device controller (2) when the predefined pin is pulled, and the global time (t aS2 ) captured at the slave device port (21) by the master device controller (2) when the predefined pin is pulled, to determine whether the difference therebetween is less than a predefined third threshold.

5. The method according to any one of claims 2 to 4, - wherein the method includes capturing the local hardware counter (c bS2 ) and the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects a pull of the predefined pin, and then updating the global time of the slave device controller (3) to the global time (t' aM2 ) of the master device controller (2) included in the subsequent message.

6. The method according to any one of claims 2 to 5, - wherein the verification message includes: The global time (t' aM2 ) that is sent from the master device controller (2) to the slave device controller (3) in the subsequent message, and - wherein verifying the time synchronization includes: checking, at the master device controller (2), a difference between the global time (t aM2 ) captured by the master device controller (2) when the predefined pin is pulled and the global time (t' aM2 ) included in the verification message is less than a predefined fourth threshold value.

7. A master device controller (2) configured to be connected to a slave device controller (3) via a private bus, wherein the master device controller (2) is configured to: - In response to the pulling of a predefined pin of the master device controller (2), send a subsequent message to the slave device controller (3) via the private bus, - wherein the subsequent message includes the global time (t') of the master device controller (2) when the predefined pin is pulled aM2 ) - In response to the sent subsequent message, receive a verification message from the slave device controller (3) via the private bus, - wherein the verification message includes the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and - By checking whether the difference between the global time (t') of the master device controller (2) when the predefined pin is pulled and the global time (t) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin is less than a predefined first threshold, to verify the time synchronization between the global time of the slave device controller (3) and the global time of the master device controller (2). aM2 ) and the global time (t) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin bS2 ) is less than a predefined first threshold, to verify the time synchronization between the global time of the slave device controller (3) and the global time of the master device controller (2).

8. The master device controller (2) according to claim 7, - wherein the verification message includes the local hardware counter (c) of the slave device controller (3) bS2 ), the local hardware counter (c bS2 ) corresponding to the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin - wherein the master device controller (2) is configured to capture the global time (t of the master device controller (2) when the predefined needle is pulled aM2 ) and - wherein the master device controller (2) is configured to verify the time synchronization of the global time of the slave device controller (3) with the global time of the master device controller (2) by checking whether the difference between the following is less than a predefined second threshold: - The global time (t aM2 ) captured by the master device controller (2) when the predefined needle is pulled, and the global time (t aM1 ) captured by the master device controller (2) in the previous cycle when the predefined needle was pulled, and the difference between them, and - corresponding to the local hardware counter (c bS2 ) of the slave device controller (3) at the global time (t bS2 ) when the slave device controller (3) detects the pulling of the predefined pin, and the local hardware counter (c bS2 ) corresponding to the global time (t bS1 ) of the slave device controller (3) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle, - Optionally, the verification message includes the local hardware counter (c bS2 ) corresponding to the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and the difference between the local hardware counter (c bS2 ) corresponding to the global time (t bS1 ) of the slave device controller (3) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle.

9. The master device controller (2) according to claim 7 or 8, wherein the master device controller (2): - comprises a master device port (22) and a slave device port (21), and each of the slave device port (21) and the master device port (22) comprises a clock, - being connected to another bus via the slave device port (21), - being configured to synchronize the global time of the clock of the slave device port (21) with the global time of the other bus, - being configured to synchronize the global time of the clock of the master device port (22) with the global time of the clock of the slave device port (21) of the master device controller (2), - Capture the global time (t aS2 ) of the slave device port (21) when the predefined needle is pulled, and - Configured to verify the time synchronization of the global time of the master device controller (2) by checking whether the difference between the global time (t aM2 ) of the master device port (22) when the predefined pin is pulled and the global time (t aS2 ) of the slave device port (21) when the predefined pin is pulled is less than a predefined third threshold.

10. A slave device controller (3) configured to be connected to a master device controller (2) via a private bus, wherein the slave device controller (3) is configured to: - receive a subsequent message from the master device controller (2) via the private bus in response to the pulling of a predefined pin of the master device controller (2), - Wherein the subsequent message includes the global time (t aM2 ) of the master device controller (2) when the predefined pin is pulled - Detect the pulling of the predefined pin of the master device controller (2), and capture the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and - By checking whether the difference between the global time (t') of the master device controller (2) included in the subsequent message and the global time (t) captured by the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin is less than a predefined first threshold, to verify the time synchronization. aM2 ) and the global time (t bS2 ) captured by the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, to verify the time synchronization.

11. The slave device controller (3) according to claim 10, wherein the slave device controller (3) is configured to: - send a verification message to the master device controller (2) via the private bus in response to the received subsequent message, - wherein the verification message includes the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, such that the master device controller (2) can verify the time synchronization by checking at the master device controller (2) the difference between the global time (t' aM2 ) of the master device controller (2) when the predefined pin is pulled and the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin to see if it is less than a predefined first threshold.

12. The slave device controller (3) according to claim 10 or 11, wherein the slave device controller (3) is configured to: - Capture the local hardware counter (c bS2 ) of the slave device controller (3), where the local hardware counter (c bS2 ) corresponds to the global time (t bS2 ) of the slave device controller (3) when the slave device controller (3) detects the pulling of the predefined pin, and - verify the time synchronization of the global time of the slave device controller (3) with the global time of the master device controller (2) by checking whether the difference between the following is less than a predefined second threshold: - The global time (t') of the master device controller (2) included in the subsequent message aM2 ) and the global time (t') of the master device controller (2) included in the subsequent message in the previous cycle aM1 ) difference, and - corresponding to the local hardware counter (c bS2 ) of the slave device controller (3) at the global time (t bS2 ) when the slave device controller (3) detects the pulling of the predefined pin, and the local hardware counter (c bS1 ) of the slave device controller (3) at the global time (t bS1 ) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle.

13. The slave device controller (3) according to claim 12, - wherein the slave device controller (3) is configured to send a verification message including the local hardware counter (c bS2 ) of the slave device controller (3) and the global time (t' aM2 ) of the master device controller (2) included in the subsequent message, such that the master device controller (2) can verify the time synchronization between the global time of the slave device controller (3) and the global time of the master device controller (2) by checking whether the difference between the following is less than a predefined second threshold: - The global time (t') of the master device controller (2) included in the verification message aM2 ) and the global time (t') of the master device controller (2) included in the verification message in the previous cycle aM1 ), and - corresponding to the local hardware counter (c bS2 ) of the slave device controller (3) at the global time (t bS2 ) when the slave device controller (3) detects the pulling of the predefined pin, and the local hardware counter (c bS1 ) of the slave device controller (3) at the global time (t bS1 ) when the slave device controller (3) detected the pulling of the predefined pin in the previous cycle.

14. The slave device controller (3) according to any one of claims 12 to 13, - wherein the slave device controller (3) is configured to update the global time (t bS2 ) of the slave device controller (3) to the global time (t' bS2 ) of the master device controller (2) included in the subsequent message after capturing the local hardware counter (c aM2 ).

15. A communication network, comprising: - a master device controller (2) according to any one of claims 7 to 9, - a slave device controller (3) according to any one of claims 10 to 14, and - a private communication bus (4) that connects the master device controller (2) and the slave device controller (3) to each other, wherein the private communication bus (4) includes a connection between a predefined pin of the master device controller (2) and the slave device controller (3).

Images