Whole vehicle safety clock system based on time synchronization protocol

Abstract

The invention discloses a vehicle safety clock system based on a time synchronization protocol. Each node comprises a clock issuing module, a clock protection module, a clock synchronization module and a clock configuration management module. The clock issuing module is used for issuing the corresponding clock reference and the function security state and the information security state of the clock reference to other application programs needing the clock reference; the clock protection module is used for protecting functional security integrity and information security integrity states in the time reference; the clock synchronization module is used for acquiring a configured clock source according to the clock identity configured in the clock configuration management module, switching the clock source according to a strategy, and synchronizing a time reference in a network by using a time synchronization protocol; and the clock configuration management module is used for configuring information of other sub-modules. The invention provides a whole vehicle-oriented clock synchronization standardization module, which can be quickly integrated and quickly configured, and establishes a whole vehicle clock synchronization mechanism meeting the safety targets of functional safety and information safety.

Description

Technical Field

[0001] The invention relates to time synchronization technology, and in particular to a vehicle safety clock system based on a time synchronization protocol. Background Art

[0002] In traditional vehicles, in order to obtain more accurate time accuracy, the controller (for example, a remote communication terminal or an intelligent driving controller) connected to a GNSS (Global Navigation Satellite System) receiver is often used as the vehicle clock source for time broadcasting, such as by sending periodic CAN synchronization messages or gPTP protocol through the controller. However, this solution has the following problems: The acquisition time of the clock source is relatively long. A conventional cold start requires several processes including satellite search, capture, tracking, decoding, pseudorange measurement and positioning calculation. The whole process takes at least 30 seconds to 1 minute.

[0003] The stability of the clock source is easily affected by RF signal interruption and interference. For example, multipath effects such as driving into an underground parking lot or under an overpass or near tall buildings can cause satellite signals to be reflected, resulting in interruptions or jumps in the timing of the GNSS clock source.

[0004] The accuracy of the clock source is limited. The GNSS clock is derived from the synchronous pulse signal PPS in the receiver. Although the accuracy can reach nanoseconds and there is no cumulative error, the GNSS receiver outputs the standard UTC time in the format of rising edges of whole seconds, which means that the clock accuracy is seconds when the vehicle network is synchronized. If there are businesses that rely on smaller units for data fusion, it may not be able to meet the requirements.

[0005] The simple application of the gPTP protocol for synchronization does not take into account the functional safety requirements of the synchronization process. If the clock synchronization process is caused by permanent hardware failure, random failure or external interference, the clock system itself cannot inform other nodes through explicit fault markings to enter the safe state of related functions, and cannot provide redundant backup clocks that can operate in the event of a failure for emergency operation for a period of time.

[0006] The simple application of the gPTP protocol for synchronization does not take into account the information security requirements of the synchronization process, so that the vehicle clock system messages have anti-tampering mechanisms and anti-replay mechanisms, cannot authenticate the clock source identity and corresponding authorization, cannot prevent middlemen from intercepting and deleting synchronization messages, or maliciously add data delays to manipulate measurement messages to modify the vehicle synchronization time benchmark. Summary of the invention

[0007] In order to solve the deficiencies in the prior art, the object of the present invention is to provide a vehicle safety clock system based on a time synchronization protocol.

[0008] To achieve the purpose of the present invention, the technical solution adopted by the present invention is: A vehicle safety clock system based on a time synchronization protocol, including a master node / backup master node, a slave node and a boundary node, each node including a clock publishing module, a clock protection module, a clock synchronization module, and a clock configuration management module; The clock publishing module publishes the corresponding clock reference and the functional safety status and information security status of the clock reference to other applications that need the clock reference; The clock protection module protects the functional safety integrity and information security integrity status of the time base. When the corresponding integrity loss is diagnosed in the system, the module will issue a failure alarm or actively switch strategies; The clock synchronization module obtains the configured clock source according to the clock identity configured in the clock configuration management module, switches the clock source according to the strategy, and uses the time synchronization protocol to synchronize the time reference in the network; The clock configuration management module configures other sub-module information, including the controller unique identifier, clock reference, clock source, clock source interface, clock acquisition mode, clock source priority, clock source switching threshold, clock source sampling period, target synchronization object, functional safety deviation threshold and functional safety deviation threshold, and redundant path key.

[0009] Furthermore, the integrity protection of functional safety includes: for nodes configured as system master nodes, backup master nodes or boundary nodes, hardware fault diagnosis of clock sources is performed; for nodes configured as slave nodes, failure alarms and redundant clock active switching strategies are triggered when the clock deviation between the redundant path and the main path reaches the configured threshold; The integrity protection of information security includes: authentication and authorization of clock identities in the network, prevention of middleman deception, integrity of redundant path and main path protocol data packets, data availability and anti-replay protection, and the configuration of redundant path clock deviation thresholds and main path and redundant path keys by the receiving configuration management module.

[0010] Furthermore, two different in-vehicle clock benchmarks are defined: the vehicle business clock benchmark and the vehicle cumulative operation clock benchmark; The vehicle business clock reference is absolute time, which is obtained from high-precision time sources based on GNSS, NITZ, and NTP in the vehicle and is the same as the user's real time; The cumulative running clock benchmark of the whole vehicle is relative time. When the main clock controller node responsible for the cumulative running clock of the whole vehicle enters the working mode, the timing starts, and when the main clock controller node responsible for the cumulative running clock of the whole vehicle enters the sleep mode, the timing stops, indicating the cumulative running time of the vehicle.

[0011] Furthermore, for the clock deviation of the redundant path and the main path, the functional safety of the whole vehicle clock system is realized. The clock slave node configures the source of the redundant clock path, uses a fully hardware redundant safety mechanism, or implements the decomposition of safety goals at the system architecture level through redundant application messages to avoid the overall clock synchronization violating the safety goals. When the clock slave node determines that the time base deviation value between the redundant path and the main path exceeds the set threshold, the corresponding clock slave node should enter the functional safety state.

[0012] Furthermore, information security integrity judgment and alarm are realized for the clock of the vehicle safety clock system by confirming the authenticity of the clock identity of each node; comparing the deviation of the time base of the redundant path and the main path from the node and implementing different information security measures for the redundant path and the main path.

[0013] Furthermore, the vehicle safety clock system determines and switches the clock source priority. The vehicle business clock master node has multiple clock sources at the same time. When the set conditions are met, the clock source is switched according to the configured priority and deviation value, including: the deviation between the new business clock source and the current business clock source exceeds X seconds; the new business clock source has the same or higher priority than the current business clock source.

[0014] Furthermore, for the hardware fault diagnosis of the clock source of the vehicle safety clock system, the clock master node detects the hardware elements related to the correctness of the vehicle business clock and the vehicle cumulative clock during the system initialization phase and operation. If there is a fault in the clock hardware related to the vehicle business clock, the business clock master node determines that the current business clock is in a faulty state and sends a fixed value of time; When it is judged that the fault is mature, it is necessary to mark the current clock synchronization status as invalid, or in a fault silent state, and no time synchronization message will occur; when the clock slave node sends a fault explicit flag through the master clock or judges that the time synchronization message has timed out, it should be judged that the master clock fault is mature, and a new system clock synchronization should be started immediately from the universal master clock.

[0015] The beneficial effect of the present invention is that, compared with the prior art, the present invention proposes a solution for defining and using different clock references of vehicles under a centralized architecture for vehicle-mounted scenarios, and provides a specification for the deployment and use of time-related functions within the vehicle. The solution for defining and coordinating the clock reference within the vehicle is designed in conjunction with the overall architecture, and combined with typical business scenarios, it is explained that the system has a flexible and flexible configuration method, which can quickly set multiple clock sources, manage clock source priorities, and switch strategies between different time sources.

[0016] The present invention proposes a clock synchronization standardization module for the whole vehicle, which can be quickly integrated and configured, and establishes a whole vehicle clock synchronization mechanism that meets the safety goals of functional safety and information security, ensures that the clock system generates functional safety issues and handles the threat scenarios that the whole vehicle clock system usually faces, meets the functional requirements of failure-operation, provides a reliable security environment and infrastructure, and will not significantly reduce the synchronization accuracy and performance of the time synchronization system itself. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the vehicle safety clock system based on the time synchronization protocol described in the present invention; Figure 2 It is a conceptual diagram of the functional safety of the vehicle clock system. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of this application.

[0019] like Figure 1 As shown, the vehicle safety clock system based on the time synchronization protocol described in the present invention is a software standardized module that can be flexibly deployed, and can adjust the clock identity according to the actual needs of the vehicle electronic architecture design, including master nodes / backup master nodes, slave nodes and boundary nodes. Regardless of the chip type of the controller, whether it is MCU (Microcontroller Unit) or SOC (System on Chip), it can be deployed on different nodes in the form of CDD (Complex Device Driver) files and software libraries.

[0020] In the vehicle safety clock system, multiple different time domains can be set to acquire time, issue time and manage time synchronization. The master node and slave node of clock synchronization can be configured according to the characteristics of each clock reference, and the processing strategies of different clocks can be configured. For the backup master node, it can usually create redundant time domains with the same nature as the master node to ensure that the slave node can switch in real time when the master node has a clock synchronization failure (the slave node needs to receive the time synchronization message of the master clock and the backup master clock at the same time). The time reference between the master node and the backup master node will be periodically aligned.

[0021] In the vehicle safety clock system, each node includes a clock release module, a clock protection module, a clock synchronization module, and a clock configuration management module. The functions of each sub-module are as follows: Clock publishing module: publishes the corresponding clock reference and the functional safety status and information security status of the clock reference to other applications that require the clock reference. If the node is configured as the system master node, backup master node or boundary node, the clock reference will also be published to the clock synchronization module and broadcast in the regional network in the form of a clock synchronization protocol.

[0022] Clock protection module: mainly protects the functional safety integrity and information security integrity status in the time base. When the corresponding integrity loss is diagnosed in the system, the system can use this module to issue a failure alarm or actively switch strategies.

[0023] The integrity protection concept of functional safety includes: for nodes configured as system master nodes, backup master nodes or boundary nodes, hardware fault diagnosis of clock sources (including initialization diagnosis and periodic diagnosis) is performed. For nodes configured as slave nodes, failure alarms and redundant clock active switching strategies are triggered when the clock deviation between the redundant path and the main path reaches the configured threshold.

[0024] The concept of information security integrity protection includes: authentication and authorization of clocks in the network, prevention of middleman deception, integrity of redundant path and main path protocol data packets, data availability and anti-replay protection, and receiving the configuration management module for the redundant path clock deviation threshold and the configuration of the main path and redundant path keys.

[0025] Clock synchronization module: mainly obtains the configured clock source according to the clock identity configured in the clock configuration management module, switches the clock source according to the strategy, and uses the time synchronization protocol to synchronize the time reference in the network.

[0026] Clock configuration management module: configure other submodules. The following information can be configured: controller unique identifier (uuid), clock reference (vehicle business clock or vehicle cumulative clock), clock source (PTP / RTC / GNSS / SYSTEM / NTP...), clock source interface, clock acquisition method (local or network), clock source priority, clock source switching (election) threshold, clock source sampling period, target synchronization object (local system clock / PTP or dedicated timer), functional safety deviation threshold and functional safety deviation threshold, and redundant path key configuration.

[0027] In order to standardize the clock reference for all possible vehicle-mounted scenarios, two different in-vehicle clock references are defined, namely the vehicle business clock reference and the vehicle cumulative operation clock reference.

[0028] The vehicle business clock benchmark refers to a classification based on the purpose and characteristics of the clock. It is absolute time, obtained from high-precision time sources such as GNSS, NITZ (Network Identity and Time Zone, time information from operator base stations), NTP (Network Time Protocol, from globally distributed high-precision time servers), etc. in the vehicle, and comes with user time zone information, which is the same as the user's real time (wall clock).

[0029] Based on the characteristics of the vehicle business clock benchmark, it can be used in the following scenarios: it can be used for user clock display, it can be used for the freeze frame time benchmark of the vehicle electronic unit failure, it can be used for the time benchmark for recording global software logs, and it can be used for the task timer for vehicle collaboration.

[0030] The cumulative running clock benchmark of the whole vehicle is relative time. When the main clock controller node responsible for the cumulative running clock of the whole vehicle enters the working mode, the timing starts, and when the main clock controller node responsible for the cumulative running clock of the whole vehicle enters sleep mode, the timing stops, indicating the cumulative running time of the vehicle. The main clock responsible for the cumulative running clock of the whole vehicle is persistently stored when it is dormant, and will not start from zero when the vehicle starts.

[0031] Based on the cumulative running clock benchmark characteristics of the whole vehicle, it can be used in the following scenarios: it can be used to coordinate the time base alignment of the whole vehicle sensor sampling data and the actuator, it can be used to coordinate the task timing and execution synchronization of the whole vehicle, it can be used as a reference for the freshness of internal communication messages in the vehicle, it can be used for the maintenance and repair of the whole vehicle, it can be used to evaluate the safety of the autonomous driving system, it can be used to evaluate scenarios related to the frequency of vehicle use, and it can be used to evaluate the impact of the vehicle on the environment.

[0032] For the clock deviation of redundant paths and main paths, the functional safety concept of the vehicle clock system is realized. The clock slave node configures the source of the redundant clock path, for example: the redundant clock path source is the clock synchronization message of the universal master clock or the redundant application message. Use a fully hardware redundant safety mechanism, or implement the decomposition of safety goals at the system architecture level through redundant application messages to avoid the overall clock synchronization from violating the safety goal (assuming that the safety goal is that the time base deviation of the whole vehicle synchronization exceeds a threshold that affects safety). Figure 2 The functional safety decomposition shown is that even if the clock synchronization passes through a bridge node that cannot prove its safety integrity, or the module responsible for clock synchronization cannot prove its safety integrity, the safety integrity of the overall clock system will not be affected because the clock safety protection module establishes a redundant channel for secure clock synchronization through a redundant channel, thus being able to prove the safety integrity of the vehicle clock synchronization.

[0033] When the clock slave node determines that the time base deviation value between the redundant path and the main path exceeds the set threshold, the corresponding clock slave node should enter the safe state of functional safety.

[0034] For the vehicle safety clock system clock, information security integrity judgment and alarm are realized by confirming the authenticity of the clock identity of each node; comparing the deviation of the time base of the redundant path and the main path from the node and implementing different information security measures for the redundant path and the main path.

[0035] The clock authentication and authorization mechanism is to prevent attackers from sending malicious messages to the master server to impersonate a legitimate clock, slave server or intermediate clock, causing the master server to respond to the legitimate clock with a protocol packet based on a spoofed message, making the clock reference itself wrong or the clock delay calculation based on wrong information, indirectly affecting the clock reference of other systems. In order to prevent attackers from impersonating the legitimate node of the vehicle business clock and modifying the vehicle business clock reference, the master node of the vehicle business clock should have a clock identity identification and authentication mechanism. The slave node can perform clock synchronization after authenticating the master node and proving that it is a legitimate clock master node or backup master node. On the other hand, authorization refers to verifying whether the peer clock is allowed to play its role in the protocol. For example, some nodes may be allowed to become a legitimate participating node in the clock synchronization system.

[0036] The priority judgment and switching of the clock source of the vehicle safety clock system, the vehicle business clock master node (including the backup master node) has multiple clock sources at the same time. When the set conditions are met, the clock source is switched according to the configured priority and deviation value, for example: the deviation between the new business clock source and the current business clock source exceeds X seconds (including the clock offset superposition calculation); the new business clock source has the same or higher priority than the current business clock source. In this way, the change of the low-priority clock source will not affect the current business time, and can also avoid frequent jumps of the business clock.

[0037] Hardware fault diagnosis of the clock source of the vehicle safety clock system. The clock master node should detect the hardware elements related to the correctness of the vehicle business clock and the vehicle cumulative clock during the system initialization phase and operation. The detection content and detection cycle can be modified according to the configuration.

[0038] If the clock hardware related to the vehicle business clock fails, the business clock master node determines that the current business clock is in a faulty state, sends a fixed time, for example: 0:00 on January 1, 1970, and marks it as invalid. If the business time obtained by the clock protection module of the vehicle business clock slave node is earlier than January 1, 2020, the current vehicle business clock is judged to be untrustworthy.

[0039] When the fault is judged to be mature, the current clock synchronization status needs to be marked as invalid, or in a fault silent state, and no time synchronization message will be generated. If the detection type is "runtime cycle check", the fault diagnosis interval is periodically detected according to the configuration; if the detection type is "initializing check", the fault diagnosis interval FHTI is executed once in each vehicle "ON-OFF" cycle.

[0040] When the clock slave node detects a fault dominant flag sent by the master clock or judges that the time synchronization message has timed out, it should be judged that the master clock failure is mature, and a new system clock synchronization should be started immediately from the universal master clock.

[0041] To ensure that the system time base does not switch repeatedly due to frequent resetting of the master clock, after the current time base is switched from the master clock to the universal master clock, the universal system master clock is always responsible for clock synchronization within the current working cycle (Power OFF→ON). If there is no subsequent hot standby clock source, some safety-related applications may need to be in a degraded operation mode (Emergency operation mode).

[0042] In order to enhance the security of the in-vehicle clock system, the clock master node (including business clock and accumulated running time) is determined by the configuration file deployed on each node, and it does not need to be generated through dynamic elections. Before the whole vehicle system synchronizes the clock, the key distribution center verifies the certificate ID or the clock service ID used in the region based on the predefined identity of each node in the network, and creates a communication ticket based on fixed identity information or a symmetric key exclusive to clock synchronization secure communication to protect the integrity of the clock synchronization protocol.

[0043] Comparing the deviation of the time base of the redundant path and the main path means that in addition to clock synchronization through gPTP, the vehicle clock master node also sends the vehicle clock message on the bus and uses the integrity protection measures and freshness verification measures of the application layer. The boundary clock node or clock slave node judges the deviation value of the vehicle business clock and the system time synchronized with itself. If one of the following conditions is met: the time in the message deviates from the current synchronized business clock source by more than X seconds; no message from the redundant path is received for more than X seconds. The clock protection module determines that the clock state at this time is the information security protection state (CS Protection Status), and informs the clock application using the relevant clock base that the current clock is unsafe through the clock release module.

[0044] Implementing different information security measures for redundant paths and main paths means using an additional transport layer communication protection mechanism for the main path (for example, using a hardware-supported MACSec or IPSec protocol), generating a tamper-proof check code (for example, HMAC) based on the content after the time synchronization message timestamp is generated, which is conducive to calculating the protection and verification time during the communication process as the link delay time, so as to ensure the time accuracy of the time synchronization network. Using the application layer protection mechanism for redundant paths, the tamper-proof check code and fresh value are placed in the application message for transmission. When the boundary clock node and the clock slave node receive the redundant path and main path clock synchronization protocol, the clock protection module will use the tamper-proof check code and fresh value information to verify whether the time stamp synchronized in the link has been tampered with or replayed. If it is judged to be tampered with or replayed, it will enter the information security protection state, and inform the upper-layer application through the clock release module that the current clock is unsafe.

[0045] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a standardized software module for rapid integration of controller units in different hardware environments, reduces development workload, provides an open clock source selection strategy, and defines two different standard vehicle clock references, so that personnel engaged in the development and design of vehicle electronics and electrical equipment can directly determine detailed designs such as master clock, slave clock deployment and priority through configuration.

[0046] The present invention provides high-functional safety clock synchronization for the entire vehicle, improving the safety integrity of business functions that rely on the clock basis. At the same time, a clock synchronization solution with fault tolerance capability is described in the system design, providing a time infrastructure that can operate despite failures.

[0047] The present invention provides information security and high-performance vehicle clock synchronization to meet the needs of information security services, such as: using relative clocks as FVs in security communications or aligning task execution scheduling; using absolute clocks to record security-related data or events, such as security logs, diagnostic freeze fault frames, and intelligent task reservations.

[0048] The design of the safety mechanism adopted in the vehicle clock system of the present invention will not significantly reduce the quality of time transmission, especially the vehicle cumulative running time benchmark which is more sensitive to accuracy and performance.

[0049] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

Claims

1. A vehicle safety clock system based on a time synchronization protocol, characterized in that: It includes master node / backup master node, slave node and boundary node. Each node includes clock release module, clock protection module, clock synchronization module and clock configuration management module. The clock publishing module publishes the corresponding clock reference and the functional safety status and information security status of the clock reference to other applications that need the clock reference; The clock protection module protects the functional safety integrity and information security integrity status of the time base. When the corresponding integrity loss is diagnosed in the system, the module will issue a failure alarm or actively switch strategies; The clock synchronization module obtains the configured clock source according to the clock identity configured in the clock configuration management module, switches the clock source according to the strategy, and uses the time synchronization protocol to synchronize the time reference in the network; The clock configuration management module configures other sub-module information, including the controller unique identifier, clock reference, clock source, clock source interface, clock acquisition mode, clock source priority, clock source switching threshold, clock source sampling period, target synchronization object, functional safety deviation threshold and functional safety deviation threshold, and redundant path key.

2. The vehicle safety clock system based on the time synchronization protocol according to claim 1 is characterized in that: Functional safety integrity protection includes: for nodes configured as system master nodes, backup master nodes or boundary nodes, hardware fault diagnosis of clock sources; for nodes configured as slave nodes, failure alarms and redundant clock active switching strategies are triggered when the clock deviation between the redundant path and the main path reaches the configured threshold; The integrity protection of information security includes: authentication and authorization of clock identities in the network, prevention of middleman deception, integrity of redundant path and main path protocol data packets, data availability and anti-replay protection, and the configuration of redundant path clock deviation thresholds and main path and redundant path keys by the receiving configuration management module.

3. The vehicle safety clock system based on the time synchronization protocol according to claim 1 is characterized in that: Define two different in-vehicle clock benchmarks: vehicle business clock benchmark and vehicle cumulative operation clock benchmark; The vehicle business clock reference is absolute time, which is obtained from high-precision time sources based on GNSS, NITZ, and NTP in the vehicle and is the same as the user's real time; The cumulative running clock benchmark of the whole vehicle is relative time. When the main clock controller node responsible for the cumulative running clock of the whole vehicle enters the working mode, the timing starts, and when the main clock controller node responsible for the cumulative running clock of the whole vehicle enters the sleep mode, the timing stops, indicating the cumulative running time of the vehicle.

4. The vehicle safety clock system based on the time synchronization protocol according to claim 2 is characterized in that: For the clock deviation of redundant paths and main paths, the functional safety of the vehicle clock system is achieved. The clock slave node configures the source of the redundant clock path, uses a fully hardware redundant safety mechanism, or implements the decomposition of safety goals at the system architecture level through redundant application messages to avoid the overall clock synchronization violating the safety goals. When the clock slave node determines that the time base deviation value between the redundant path and the main path exceeds the set threshold, the corresponding clock slave node should enter the functional safety state.

5. The vehicle safety clock system based on the time synchronization protocol according to claim 2 is characterized in that: For the vehicle safety clock system clock, information security integrity judgment and alarm are realized by confirming the authenticity of the clock identity of each node; comparing the deviation of the time base of the redundant path and the main path from the node and implementing different information security measures for the redundant path and the main path.

6. The vehicle safety clock system based on the time synchronization protocol according to claim 2 is characterized in that: The vehicle safety clock system clock source priority judgment and switching, the vehicle business clock master node has multiple clock sources at the same time. When the set conditions are met, the clock source is switched according to the configured priority and deviation value, including: the deviation between the new business clock source and the current business clock source exceeds X seconds; the new business clock source has the same or higher priority than the current business clock source.

7. The vehicle safety clock system based on the time synchronization protocol according to claim 2 is characterized in that: Hardware fault diagnosis of the clock source of the vehicle safety clock system. The clock master node detects the hardware elements related to the correctness of the vehicle business clock and the vehicle cumulative clock during the system initialization phase and operation. If there is a fault in the clock hardware related to the vehicle business clock, the business clock master node determines that the current business clock is in a faulty state and sends a fixed value of time. When the fault is judged to be mature, the current clock synchronization state needs to be marked as invalid, or in a fault silent state, and no time synchronization message will be generated; When the clock slave node detects a fault dominant flag sent by the master clock or judges that the time synchronization message has timed out, it should be judged that the master clock failure is mature, and a new system clock synchronization should be started immediately from the universal master clock.

Images