AFDX (Avionics Full Duplex Switched Ethernet) terminal time high integrity checking method based on global clock synchronization

Abstract

The invention discloses an AFDX (Avionics Full Duplex Switched Ethernet) terminal time high-integrity checking method based on global clock synchronization. The method comprises the following steps: firstly, setting the maximum time difference Dmax of each AFDX terminal allowing a message to arrive; then, carrying out AFDX network global clock synchronization; acquiring a timestamp STS when the first byte of the message leaves the sending terminal and a timestamp MTS when the first byte of the message reaches the receiving terminal; and finally, subtracting the time STS when the first byte of the message leaves the sending terminal from the time MTS when the first byte of the message arrives at the receiving terminal, and if the value is smaller than Dmax, considering that the message passes time high-integrity verification and is received; otherwise, considering that the time high integrity verification fails, and discarding the message. According to the method, the software complex calculation of the TOS is avoided, and the high-integrity time verification efficiency of the AFDX terminal is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of high-integrity AFDX network design, and in particular relates to a high-integrity verification method for AFDX terminal time based on global clock synchronization. Background Art

[0002] Avionic Full-Duplex Switched Ethernet (AFDX / ARINC664) is a deterministic aircraft data network bus system suitable for avionics system information transmission. It is based on standard IEEE802.3 technology and defines a standard for avionics electrical and protocol specifications.

[0003] Error Detection Encoding (EDE) is a protocol that allows the receiver to identify the authenticity of the received message, including source and bit high integrity check, sequence high integrity check and time high integrity check. The onboard network system has high requirements for data certainty. During data transmission, the message receiving end ES has a timeout limit. After waiting for a maximum period of time (Dmax), if the message has not been received, it should be discarded when it is received. That is, it is necessary to ensure that the message is received within the Dmax time range. This is the time high integrity check, which verifies the message Age based on the sending timestamp and receiving time in the message.

[0004] In the AFDX network system, the clock sources of each terminal device are asynchronous, and each maintains a clock counter. In order to perform high-integrity time verification, the traditional approach is to calculate the clock deviation (Time Offset, TOS) between the source terminal and the destination terminal based on software; when a message is received, the Age (receive timestamp-send timestamp + TOS) is calculated. If it is within the Dmax range, it is considered to have passed the high-integrity time verification. This method of calculating TOS based on software has a high CPU occupancy rate, low performance, poor accuracy, and complex calculations, which raises the barriers to the design and application of high-integrity AFDX terminal systems. Summary of the invention

[0005] The purpose of the present invention is to provide an AFDX terminal time high integrity verification method based on global clock synchronization, to globally synchronize the clocks of each node in the AFDX network system, to avoid the complex software calculation of TOS, to improve the efficiency of AFDX terminal high integrity time verification, to reduce the design complexity, and to facilitate the full hardware implementation of AFDX high integrity verification.

[0006] The object of the present invention is achieved through the following technical solutions:

[0007] A method for high integrity verification of AFDX terminal time based on global clock synchronization comprises the following steps:

[0008] S1, set the maximum time difference Dmax allowed for message arrival at each AFDX terminal;

[0009] S2, perform global clock synchronization of AFDX network;

[0010] S3, obtain the timestamp STS of the first byte of the message leaving the sending terminal;

[0011] S4, obtain the timestamp MTS of the first byte of the message arriving at the receiving terminal;

[0012] S5, the time MTS when the first byte of the message arrives at the receiving terminal minus the time STS when the first byte of the message leaves the sending terminal. If this value is less than Dmax, the message is considered to have passed the time high integrity check and is received; otherwise, the time high integrity check is considered to have failed and the message is discarded.

[0013] Preferably, step S2 is implemented using the IEEE1588 protocol, and all AFDX terminals exchange P2P messages with adjacent nodes. Assuming that any two adjacent AFDX terminals are node 1 and node 2, specifically:

[0014] S21A, node 1 sends a Pdelay_Req message at time t1; node 2 receives the Pdelay_Req message at time t2 and generates a timestamp t2 for receiving the message; node 2 sends a Pdelay_Resp message carrying a timestamp t2 at time t3 and generates a timestamp t3 for sending the Pdelay_Resp message; node 1 receives the Pdelay_Resp message at time t4; node 2 sends a Pdelay_resp_follow_up message carrying a timestamp t3 to node 1; finally, the average path delay between node 1 and node 2 is obtained as Tmean_pdelay=[(t4-t1)-(t3-t2)] / 2;

[0015] S22A, Node 1 sends a Sync message at time t5 and carries the t5 information in the Follow_up message; Node 2 receives the Sync message at time t6 and calculates that the time deviation of Node 2 relative to Node 1 is Toffset = t6-t5-Tmean_pdelay;

[0016] S23A, node 2 adjusts the local time according to the time deviation Toffset, thereby achieving clock synchronization of the entire AFDX network.

[0017] Preferably, step S2 implements global clock synchronization based on RTC data frame timing, comprising the following steps:

[0018] S21B, determine an AFDX terminal as the master node, and all other nodes are slave nodes. The master node constructs an RTC data frame and adds a timestamp in the Payload field. The timestamp is calculated by adding the sending time point, the switch technical delay, and the switch average forwarding delay.

[0019] S22B, the master node periodically sends RTC frames to all slave nodes through the configured RTC dedicated virtual link;

[0020] S23B, after receiving the RTC frame, the slave node parses out the timestamp therein and uses it to update the local clock counter, thereby synchronizing the global clock to the master node clock.

[0021] Preferably, in step S3, the sending terminal locally maintains a local clock counter, which keeps accumulating after power-on reset; when the first byte of the message leaves the sending terminal, the local clock counter count is stamped at a specific position of the message as an STS timestamp.

[0022] Preferably, in step S4, the receiving terminal locally maintains a local clock counter, which keeps accumulating after power-on reset; when the message is completely received at the receiving terminal, the count of the local clock counter is recorded as the MTS timestamp.

[0023] The beneficial effects of the present invention are:

[0024] The present invention designs and implements high integrity verification of AFDX terminal time through two global clock synchronization methods; one is based on 1588 protocol to implement high-precision global clock synchronization, and the synchronization accuracy can reach within 100ns; the other is based on RTC data frame timing to implement global clock synchronization, which can be implemented by full hardware design. The high integrity verification method of AFDX terminal time based on global clock synchronization proposed by the present invention can reduce the software calculation complexity and the overall design complexity, which is conducive to the full hardware implementation of high integrity of AFDX terminal time; messages can only be received within a reasonable time range, eliminating certain message transmission errors, and ensuring the high time integrity of the AFDX network. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of the overall process of a high-integrity verification method for AFDX terminal time based on global clock synchronization provided by an embodiment of the present invention;

[0026] Figure 2 A schematic diagram of calculating adjacent node delays using the 1588P2P mechanism provided in an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of clock synchronization implemented by the 1588P2P mechanism provided in an embodiment of the present invention;

[0028] Figure 4 A schematic diagram of a time high integrity check provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0030] See also Figure 1 As shown, the AFDX terminal time high integrity verification method based on global clock synchronization shown in this embodiment includes the following steps:

[0031] S1, set the maximum time difference Dmax allowed for message arrival at each AFDX terminal.

[0032] According to the scale and mode of AFDX network, evaluate, calculate and reasonably set the maximum time difference Dmax allowed for message arrival at each AFDX terminal.

[0033] S2, perform global clock synchronization of the AFDX network.

[0034] This embodiment provides two global clock synchronization methods for illustration.

[0035] The first global clock synchronization method is implemented using the IEEE1588 protocol. All AFDX terminals exchange P2P messages with adjacent nodes. Each AFDX terminal can calculate the link delay between itself and its adjacent nodes, thereby achieving synchronization of the entire network.

[0036] This embodiment is described by taking any two AFDX terminals as an example, assuming that the two AFDX terminals are node 1 and node 2, where node 1 is a master node and node 2 is a slave node. Specifically:

[0037] S21A, such as Figure 2 As shown, node 1 sends a Pdelay_Req message at time t1; node 2 receives the Pdelay_Req message at time t2, and generates a timestamp t2 for receiving the message; node 2 sends a Pdelay_Resp message carrying a timestamp of t2 at time t3, and generates a timestamp t3 for sending the Pdelay_Resp message; node 1 receives the Pdelay_Resp message at time t4; node 2 sends a Pdelay_resp_follow_up message carrying a timestamp of t3 to node 1; finally, node 1 obtains four sets of timestamps, and the average path delay Tmean_pdelay=[(t4-t1)-(t3-t2)] / 2 can be obtained.

[0038] S22A, such as Figure 3 As shown, node 1 sends a Sync message at time t5 and carries the t5 information in the Follow_up message; node 2 receives the Sync message at time t6. It can be calculated that the time deviation of the slave node relative to the master node is Toffset = t6-t5-Tmean_pdelay.

[0039] S23A, node 2 adjusts the local time according to the time deviation Toffset, thereby achieving clock synchronization of the entire AFDX network.

[0040] Through the above steps, all nodes can actively synchronize with adjacent nodes, thereby achieving synchronization of the entire network.

[0041] The second global clock synchronization method is the global timing RTC implemented by hardware, specifically:

[0042] S21B, determine an AFDX terminal as the master node, and all other nodes are slave nodes. The master node constructs an RTC data frame and adds a timestamp in the Payload field. The timestamp is calculated by adding the sending time point plus the switch technical delay plus the switch average forwarding delay, and the accuracy is in the order of microseconds. As an example, in this embodiment, the fixed frame length of the RTC frame is 64B, the first 8 fields of the Payload are timestamps, and the rest are all padded with 0s.

[0043] S22B, the master node periodically sends RTC frames to all slave nodes through the configured RTC dedicated virtual link;

[0044] S23B, after receiving the RTC frame, the slave node parses out the timestamp therein and uses it to update the local clock counter, thereby synchronizing the global clock to the master node clock.

[0045] S3, obtain the timestamp STS of the first byte of the message leaving the sending terminal;

[0046] The sending terminal maintains a local clock counter locally, which keeps accumulating after power-on reset. When the first byte of the message leaves the sending terminal, the local clock counter count is stamped at a specific position in the message (according to the EDE protocol, the first 8B data of the payload is 2B of MSN and 6B of EDE Timestamp) as the STS timestamp.

[0047] S4, obtain the timestamp MTS of the first byte of the message arriving at the receiving terminal;

[0048] The receiving terminal locally maintains a local clock counter, which continuously increments after power-on reset; when the EDE message is completely received at the receiving terminal, the count of this local clock counter is recorded as the MTS timestamp.

[0049] S5. The time MTS when the first byte of the message arrives at the receiving terminal minus the time STS when the first byte of the message leaves the sending terminal. If this value is less than Dmax, it is considered that the message passes the high-integrity time check and is received; otherwise, it is considered that the high-integrity time check fails and the message is discarded.

[0050] As Figure 4 shown, the program logic is as follows:

[0051] (1) Determine whether the high-integrity time check switch EDE_Time_Check_EN is enabled; if it is not enabled, it is considered that the high-integrity time check is passed;

[0052] (2) If EDE_Time_Check_EN is enabled, check whether Dmax is 0; if Dmax is 0, no integrity check is performed and it is considered that the high-integrity time check is passed;

[0053] (3) If EDE_Time_Check_EN is enabled and Dmax is not 0, compare the MTS and STS values. If MTS is not greater than STS, it is considered that the high-integrity time check is passed;

[0054] (4) If EDE_Time_Check_EN is enabled and Dmax is not 0, and it is judged that 0 < MTS - STS <= Dmax, it is considered that the high-integrity time check is passed;

[0055] (5) Otherwise, it is considered that the high-integrity time check fails and the received message should be discarded.

[0056] It can be understood that for those of ordinary skill in the art, equivalent substitutions or changes can be made according to the technical solution and inventive concept of the present invention, and all such changes or substitutions should fall within the protection scope of the claims appended to the present invention.

Claims

1. A high integrity verification method for AFDX terminal time based on global clock synchronization, characterized in that The following steps are involved: S1, set the maximum time difference Dmax allowed for message arrival at each AFDX terminal; S2, perform global clock synchronization of AFDX network; S3, obtain the timestamp STS of the first byte of the message leaving the sending terminal; S4, obtain the timestamp MTS of the first byte of the message arriving at the receiving terminal; S5, the time MTS when the first byte of the message arrives at the receiving terminal minus the time STS when the first byte of the message leaves the sending terminal. If this value is less than Dmax, the message is considered to have passed the time high integrity check and is received; otherwise, the time high integrity check is considered to have failed and the message is discarded.

2. According to claim 1, a method for high integrity verification of AFDX terminal time based on global clock synchronization is characterized in that Step S2 is implemented using the IEEE1588 protocol. All AFDX terminals exchange P2P messages with adjacent nodes. Assume that any two adjacent AFDX terminals are node 1 and node 2. Specifically: S21A, node 1 sends a Pdelay_Req message at time t1; node 2 receives the Pdelay_Req message at time t2 and generates a timestamp t2 for receiving the message; node 2 sends a Pdelay_Resp message carrying a timestamp t2 at time t3 and generates a timestamp t3 for sending the Pdelay_Resp message; node 1 receives the Pdelay_Resp message at time t4; node 2 sends a Pdelay_resp_follow_up message carrying a timestamp t3 to node 1; finally, the average path delay between node 1 and node 2 is obtained as Tmean_pdelay=[(t4-t1)-(t3-t2)] / 2; S22A, node 1 sends a Sync message at time t5 and carries the t5 information in a Follow_up message; Node 2 receives the Sync message at time t6 and calculates that the time offset of node 2 relative to node 1 is Toffset = t6 - t5 - Tmean_pdelay; S23A, node 2 adjusts the local time according to the time deviation Toffset, thereby achieving clock synchronization of the entire AFDX network.

3. The AFDX terminal time high integrity verification method based on global clock synchronization according to claim 1 is characterized in that Step S2 implements global clock synchronization based on RTC data frame timing, including the following steps: S21B, determine an AFDX terminal as the master node, and all other nodes are slave nodes. The master node constructs an RTC data frame and adds a timestamp in the Payload field. The timestamp is calculated by adding the sending time point, the switch technical delay, and the switch average forwarding delay. S22B, the master node periodically sends RTC frames to all slave nodes through the configured RTC dedicated virtual link; S23B, after receiving the RTC frame, the slave node parses out the timestamp therein and uses it to update the local clock counter, thereby synchronizing the global clock to the master node clock.

4. The AFDX terminal time high integrity verification method based on global clock synchronization according to claim 1 is characterized in that In step S3, the sending terminal locally maintains a local clock counter, which keeps accumulating after power-on reset; when the first byte of the message leaves the sending terminal, the local clock counter count is stamped at a specific position of the message as the STS timestamp.

5. The method for high integrity verification of AFDX terminal time based on global clock synchronization according to claim 1 is characterized in that In step S4, the receiving terminal locally maintains a local clock counter, which keeps accumulating after power-on reset; When the message is completely received at the receiving terminal, the local clock counter count is recorded as the MTS timestamp.

Images