A master clock switching method and system based on network status

Abstract

The present invention discloses a master clock switching method and system based on network status, the method comprising: when the master clock is working, if a master clock node senses a link failure and reports it, switching to a backup master clock; when the backup master clock is working, if a backup master clock node senses a link failure and reports it, switching to the master clock; when a slave clock node senses a link failure and reports it, judging whether the slave clock node is an important slave node; if the slave clock node is an important slave node, judging whether the master clock is working or the backup master clock is working; if the master clock is working, switching to the backup master clock; if the backup master clock is working, switching to the master clock. The master clock switching method and system based on network status provided by the present invention have high efficiency in fault location, reduce the possibility of wrong switching of the master clock or failure to correctly switch the master clock, and have high security and reliability.

Description

Technical Field

[0001] The invention belongs to the field of aviation technology, and in particular relates to a master clock switching method and system based on network status. Background Art

[0002] The avionics network is an important member of the airborne system. The network generally contains flight safety data and requires extremely high reliability and security. Therefore, the avionics network system generally includes 2 or more master clocks and backup master clocks. At present, time synchronization is generally required in aviation avionics communication networks. Once a synchronization link failure occurs in the network, the deviation between the slave node time and the master node time will become larger and larger, and even cause a large amount of network data errors or loss. The avionics network system needs to have the function of automatically detecting and restoring network time synchronization.

[0003] At present, IEEE 1588 (PTP, a precision clock synchronization protocol standard for network measurement and control systems) or IEEE802.1AS (gPTP general precision time protocol) is generally used in aviation avionics communication networks. In both protocols, a master clock node is used to send synchronization time in the link, and each slave clock node follows the master clock step by step through synchronization and follow messages to continuously correct the local clock.

[0004] Among them, in the event of a failure, the BMCA algorithm specified in IEEE802.1AS can select the best master clock or select the next master clock according to the configuration priority. However, this method does not provide a rational evaluation of the selection from a security perspective. It only provides a method for selecting a backup master clock, but cannot perform safe selection and switching. This method does not meet the basic requirements of aviation for source selection and switching of backup systems and cannot be used in the aviation field.

[0005] In the TSN DP protocol, only the basic idea of ​​the fault-tolerant timing module to perform clock fault-tolerant logic judgment is defined, without providing specific logic and implementation methods. This makes the module likely to encounter multiple problems in actual scenarios. First, the existing technology cannot guarantee the correct switching of the master clock for repair in the case of slave node failure. Secondly, unstable faulty links and non-important slave node failures may cause unnecessary switching of the master clock; it takes several notification message cycles to judge the link failure and replace the backup master clock, which may cause the network to work in an abnormal state for a long time, that is, the gap between the local clock and the master clock gradually increases to an unacceptable level, and even long-term communication interruption; finally, under certain invisible fault conditions, it cannot be guaranteed that the faulty master clock stops sending notification messages, making it impossible for the backup master clock to take over. Summary of the invention

[0006] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a master clock switching method and system based on network status, which has high fault location efficiency, reduces the possibility of erroneous switching of the master clock or failure to correctly switch the master clock, and has high security and reliability.

[0007] The present invention provides the following technical solutions: In a first aspect, a master clock switching method based on network status is provided, comprising: When the master clock is working, if a master clock node senses a link failure and reports it, it switches to the backup master clock; When the backup master clock is working, if a backup master clock node senses a link failure and reports it, it switches to the master clock; When the slave clock node senses a link failure and reports it, it determines whether the slave clock node is an important slave node; If the slave clock node is an important slave node, determine whether the master clock or the backup master clock is working; if the master clock is working, switch to the backup master clock; if the backup master clock is working, switch to the master clock.

[0008] Furthermore, when the slave clock node senses a link failure and reports it, if it is determined that the slave clock node is a non-important slave node, the master clock is not switched and the master clock switching process is exited.

[0009] Further, the method for sensing and reporting a link failure from a clock node includes: The slave clock node obtains the master clock timestamp and the local timestamp at a preset interval, and calculates the deviation between the master clock timestamp and the local timestamp, wherein the slave clock node perceives the master clock timestamp by receiving the synchronization message of the master clock; When the slave clock node fails to receive a synchronization message within the preset time or the deviation calculated from the slave clock node is abnormal, it is considered that the synchronization link has failed and a fault flag is reported through the network. At this time, the process of correcting the local time is stopped and the local clock relies on its own time to maintain.

[0010] Furthermore, the deviation anomaly includes: one or more consecutive deviations are greater than a first preset threshold, or the deviation is not greater than the first preset threshold but exceeds a second preset threshold after accumulation within a preset time.

[0011] Furthermore, the first preset threshold and the second preset threshold are defined by clock synchronization accuracy requirements and are set to three times the average value of the accuracy or the standard deviation of the accuracy.

[0012] Furthermore, the link failure reported by the master clock node or the link failure reported by the backup master clock node includes: the loss of a delay request message from an adjacent important slave node, or knowing through a notification message that a slave clock node is lost for more than a preset time, and the preset time is set to be shorter than the refresh time of the important communication message.

[0013] Furthermore, when the master clock is working, if there is a contradiction between the link fault information reported by the master clock node and the slave clock node, the deviation information measured in the standby master clock domain maintained by the standby master clock is used as a judgment condition; If the master clock in the backup master clock domain does not receive a synchronization message within the preset time, or obtains one or more consecutive deviations greater than the first preset threshold from the clock node, or the deviation is not greater than the first preset threshold but exceeds the second preset threshold after accumulation within the preset time, it is considered a link failure.

[0014] Furthermore, when the backup master clock is working, if there is a contradiction between the link fault information reported by the backup master clock node and the slave clock node, the deviation information measured in the master clock domain maintained by the master clock is used as a judgment condition; If the backup master clock in the master clock domain does not receive a synchronization message within the preset time, or obtains one or more consecutive deviations greater than the first preset threshold from the clock node, or the deviation is not greater than the first preset threshold but exceeds the second preset threshold after accumulation within the preset time, it is considered a link failure.

[0015] Furthermore, if the number of master clock switchings exceeds a preset number in the same scenario, it is considered that the same fault is repeatedly triggered, and the master clock switching process is locked.

[0016] In a second aspect, a master clock switching system based on network status is provided, comprising: A first master clock switching module is used to switch to a backup master clock if a master clock node senses a link failure and reports it when the master clock is working; The second master clock switching module is used to switch to the master clock if a backup master clock node senses a link failure and reports it when the backup master clock is working; The third master clock switching module is used to determine whether the slave clock node is an important slave node when the slave clock node senses a link failure and reports it; if the slave clock node is an important slave node, determine whether the main clock or the backup master clock is working; if the main clock is working, switch to the backup master clock; if the backup master clock is working, switch to the main clock.

[0017] Compared with the prior art, the present invention has the following beneficial effects: (1) In the present invention, each network node specifies a role according to the TSN protocol, including a master clock, a reserve master clock, an important slave node, and a non-important slave node; when a slave clock node senses a link failure and reports it, it determines whether the slave clock node is an important slave node. On the one hand, it ensures that the time synchronization failure of an important slave node can trigger the master clock to switch to a backup master clock or from a backup master clock to a master clock. On the other hand, it ensures that non-important slave nodes do not cause the master clock to switch, thereby reducing unnecessary master clock switching actions in the prior art. (2) The present invention proposes multiple situations in which the master clock node senses a link failure, the backup master clock node senses a link failure, and the slave clock node senses a link failure, and then reports the failure to the logic calculation unit for decision-making. The process is more in line with aviation processing logic, has high fault location efficiency, and is safer and more reliable. It reduces the possibility of erroneous switching of the master clock or failure to correctly switch the master clock, and ensures stable synchronization of the clock. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a schematic diagram of the structure of the avionics network shown in Example 2 of the present invention; Figure 2 It is a schematic diagram of the process of switching the master clock of the avionics network shown in Embodiment 2 of the present invention; Figure 3 is a schematic diagram of the structure of the avionics network shown in Example 3 of the present invention; Figure 4 is a schematic diagram of the structure of the avionics network shown in Example 4 of the present invention; Figure 5 It is a schematic diagram of the process of switching the master clock of the avionics network shown in Example 4 of the present invention. DETAILED DESCRIPTION

[0019] The technical solution of the present invention is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations on the technical solution of the present invention. The embodiments of the present invention and the technical features in the embodiments may be combined with each other unless there is a conflict.

[0020] The term "and / or" is only a description of the association relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " generally indicates that the related objects are in an "or" relationship.

[0021] Example 1

[0022] This embodiment provides a method for switching a master clock based on network status, which is as follows: When the master clock is working, if a master clock node senses a link failure and reports it, it switches to the backup master clock; When the backup master clock is working, if a backup master clock node senses a link failure and reports it, it switches to the master clock; When the slave clock node senses a link failure and reports it, it determines whether the slave clock node is an important slave node; if the slave clock node is a non-important slave node, the master clock is not switched and the master clock switching process is exited; if the slave clock node is an important slave node, it determines whether the master clock or the backup master clock is working; if the master clock is working, it switches to the backup master clock; if the backup master clock is working, it switches to the master clock.

[0023] The link failure reported by the master clock node includes: the loss of the delay request message of the adjacent important slave node, or the loss of a slave clock node for more than a preset time through the notification message; the preset time makes the network failure exposure time within a preset range, such as 100ms, so the preset time must be set to be shorter than the refresh time of the important communication message, such as 200ms. At this time, the master clock node will report the link failure to the upper computer.

[0024] The link failure reported by the backup master clock node is similar to the link failure reported by the aforementioned master clock node, including: the loss of a delay request message from an adjacent important slave node, or the loss of a slave clock node for more than a preset time period through a notification message; the preset time period is set to be shorter than the refresh time of important communication messages.

[0025] The method for sensing and reporting a link failure from a clock node includes: The slave clock node obtains the master clock timestamp and the local timestamp at a preset interval, and calculates the deviation between the master clock timestamp and the local timestamp, wherein the slave clock node perceives the master clock timestamp by receiving the synchronization message of the master clock; After the first clock synchronization is completed, the deviation is basically kept within a very small fluctuation range. According to this feature, when the slave clock node fails to receive the synchronization message within the preset time or the deviation calculated by the slave clock node is abnormal, it is considered that the synchronization link has failed, and a fault flag is reported through the network. At this time, the process of correcting the local time by synchronizing with the master clock is stopped, and the local clock relies on its own time to maintain.

[0026] Furthermore, the deviation anomaly includes: one or more consecutive deviations are greater than the first preset threshold, or the deviation is not greater than the first preset threshold, but exceeds the second preset threshold after accumulation within a preset time. The accumulation within the above preset time can be used as a suitable filter to remove repeated switching caused by unstable links, and the second preset threshold is used to limit the error tolerance accumulated over a long period of time. The first preset threshold and the second preset threshold are defined by the clock synchronization accuracy requirements, such as being set to the average value of the accuracy or 3 times the standard deviation of the accuracy.

[0027] In actual scenarios, network failures often manifest themselves in complex ways, and there may be contradictions between the information reported by the master clock node / backup master clock node and the slave clock node. From the perspective of aviation avionics safety and robustness, at least a third source of judgment marks is required to participate in the host's arbitration of failures and master clock switching. The master clock switching can only be triggered when at least two of the three judgment marks are confirmed.

[0028] In this embodiment, when the master clock is working, if there is a contradiction between the link fault information reported by the master clock node and the slave clock node, the deviation information measured in the standby master clock domain maintained by the standby master clock is used as a judgment condition; specifically, if the master clock in the standby master clock domain does not receive a synchronization message within a preset time, or the slave clock node obtains one or more consecutive deviations greater than a first preset threshold, or the deviation is not greater than the first preset threshold but exceeds the second preset threshold after accumulation within a preset time, it is deemed to be a link failure.

[0029] In this embodiment, when the backup master clock is working, if there is a contradiction between the link fault information reported by the backup master clock node and the slave clock node, the deviation information measured in the master clock domain maintained by the master clock is used as a judgment condition; specifically, if the backup master clock in the master clock domain does not receive a synchronization message within a preset time, or one or more consecutive deviations obtained from the slave clock node are greater than a first preset threshold, or although the deviation is not greater than the first preset threshold, it exceeds the second preset threshold after accumulation within a preset time, it is deemed to be a link failure.

[0030] If the number of master clock switching exceeds the preset number in the same scenario, it is considered that the same fault has been repeatedly triggered, and the master clock switching process is locked.

[0031] Example 2

[0032] This embodiment takes a relatively simple avionics network as an example and adopts the method described in Embodiment 1 to perform master clock switching.

[0033] like Figure 1As shown, in the avionics network, the master clock node 101 is generally a network terminal device, the backup master clock node 103 is a switch or a terminal device, and the slave clock node A 102 and the slave clock node B 104 are generally switches. The master clock domain 105 is statically configured as the default clock domain after startup, the red dotted line is the link in the master clock domain 105, and the black solid line is the link in the backup clock domain 106, such as: link ①, link ②, link ③ and link ④.

[0034] like Figure 2 As shown, described Figure 1 The process of decision-making for switching the backup master clock in the avionics network: Step 201, the slave clock node senses the link failure and reports it. Link failure can be in many situations, such as not receiving synchronization messages within a certain period of time, or obtaining one or more consecutive deviations from the slave clock node that are greater than the specified threshold 1, or the deviation is not greater than threshold 1 but exceeds threshold 2 after a certain period of accumulation. When there are more than one slave clock, this module represents all the faults reported by the slave clocks; Step 202: The master clock node continuously self-detects link failures and reports them; Step 203: The standby master clock node continuously self-detects link failures and reports them; Step 204: The link failures in steps 201 to 203 are reported to the host computer, which receives the reported information and makes a comprehensive judgment on the logic; Step 205: When the logic result is "yes", the host sends a command message for switching the backup master clock.

[0035] Furthermore, the upper computer compares the information status of all nodes received from the avionics network of this embodiment, and illustrates a set of logic for determining the master clock switching based on the status of the entire network. When only one fault occurs, the logic of the voting mechanism is as shown in Table 1.

[0036] Table 1 Voting mechanism logic in case of any failure

[0037] In Table 1, X represents node failure, Y represents that the failure can be confirmed from the device, and N / A represents that the device cannot provide feedback; Feedback 1, Feedback 2, Feedback 3, and Feedback 4 represent the device feedback from the slave clock node A, slave clock node B, master clock, and backup master clock, respectively.

[0038] As can be seen from Table 1, the voting mechanism can ensure that when there is only one fault, at least two nodes will report the same fault judgment information to the host, so that the host can correctly judge and switch to the backup master clock.

[0039] Example 3

[0040] The avionics network is not limited to the node combination in Example 2. When more slave clock nodes are connected to the avionics network, a slave clock node failure will receive feedback from the master clock node, the backup master clock node, and multiple slave clock nodes. The basic fault judgment logic can still be derived according to the basic network architecture.

[0041] like Figure 3 As shown, in a more complex avionics network situation, the slave clock node C 307 accesses the master clock domain 305 and the backup master clock domain 306 from the slave clock node A 302 and the slave clock node B 304 respectively. Link ⑤ and link ⑥ belong to the master clock domain 305 and the backup master clock domain 306 respectively. The failure of the slave node C 307 can be sensed by the slave clock node A and the slave clock node B respectively. If link ⑤ fails, the slave clock node A 302 and the slave clock node C 307 can sense the failure. If link ⑥ fails, the slave clock node B 304 and the slave clock node C 307 can sense the failure. The host computer issues a switching instruction for the backup master clock based on multiple perception signals. The access of other slave nodes is similar to that of the slave clock node C.

[0042] Example 4

[0043] In view of the fact that slave clock nodes with low security levels may appear in more complex avionics networks, non-important nodes need to be pre-defined in the fault judgment logic of complex networks.

[0044] like Figure 4 The figure shows a situation with different slave clock nodes. Slave clock node C 407 is an important slave node, and slave clock node D 410 is configured as a non-important slave node, that is, when slave clock node A 402 and slave clock node B 404 sense that the delay feedback message of slave clock node D 410 is abnormal, no matter it is caused by slave clock node D 410 or link ⑦ or link ⑧, there is no need to switch the backup master clock for this fault.

[0045] like Figure 5 The figure shows the method flow of switching the master clock using the method described in Example 1 when there are pre-configured non-important slave nodes in the above-mentioned complex avionics network: Step 501: The slave clock node senses a link failure and reports it; Step 502: determine whether the slave clock node is an important slave node. If the slave clock node is a non-important slave node, do not switch the master clock. If the slave clock node is an important slave node, proceed to step 503. Step 503, determine whether the main clock is working or the backup main clock is working, if the main clock is working, proceed to step 506; if the backup main clock is working, proceed to step 507; Step 504: When the master clock is working, if a master clock node senses a link failure and reports it, proceed to step 506; Step 505: When the backup master clock is working, if a backup master clock node senses a link failure and reports it, proceed to step 507; Step 506: Switch to the backup master clock; Step 507: switch to the main clock.

[0046] By adopting the method of the present invention, on the one hand, it is ensured that the time synchronization failure of important slave nodes can trigger the master clock to switch to the backup master clock or from the backup master clock to the master clock, and on the other hand, it is ensured that non-important slave nodes do not cause the master clock to switch, thereby reducing unnecessary master clock switching actions in the prior art.

[0047] Example 5

[0048] Based on the same inventive concept as that of Embodiment 1, this embodiment provides a master clock switching system based on network status, including: A first master clock switching module is used to switch to a backup master clock if a master clock node senses a link failure and reports it when the master clock is working; The second master clock switching module is used to switch to the master clock if a backup master clock node senses a link failure and reports it when the backup master clock is working; The third master clock switching module is used to determine whether the slave clock node is an important slave node when the slave clock node senses a link failure and reports it; if the slave clock node is an important slave node, determine whether the main clock or the backup master clock is working; if the main clock is working, switch to the backup master clock; if the backup master clock is working, switch to the main clock.

[0049] The specific functional implementation of each of the above modules can be found in the relevant contents of the method in Example 1 and will not be elaborated here.

[0050] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0051] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0052] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0053] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0054] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A master clock switching method based on network status, characterized in that: include: When the master clock is working, if a master clock node senses a link failure and reports it, it switches to the backup master clock; When the backup master clock is working, if a backup master clock node senses a link failure and reports it, it switches to the master clock; When the slave clock node senses a link failure and reports it, it determines whether the slave clock node is an important slave node; If the slave clock node is an important slave node, determine whether the master clock is working or the backup master clock is working; If the main clock is working, switch to the backup main clock; If the backup master clock is working, switch to the master clock.

2. The master clock switching method based on network status according to claim 1, characterized in that: When the slave clock node senses a link failure and reports it, if it determines that the slave clock node is a non-important slave node, it does not switch the master clock and exits the master clock switching process.

3. The master clock switching method based on network status according to claim 1, characterized in that: The method for sensing and reporting a link failure from a clock node includes: The slave clock node obtains the master clock timestamp and the local timestamp at a preset interval, and calculates the deviation between the master clock timestamp and the local timestamp, wherein the slave clock node perceives the master clock timestamp by receiving the synchronization message of the master clock; When the slave clock node fails to receive a synchronization message within the preset time or the deviation calculated from the slave clock node is abnormal, it is considered that the synchronization link has failed and a fault flag is reported through the network. At this time, the process of correcting the local time is stopped and the local clock relies on its own time to maintain.

4. The master clock switching method based on network status according to claim 3, characterized in that: The deviation anomaly includes: one or more consecutive deviations are greater than the first preset threshold, or the deviation is not greater than the first preset threshold but exceeds the second preset threshold after accumulation within a preset time.

5. The master clock switching method based on network status according to claim 4, characterized in that: The first preset threshold and the second preset threshold are defined by clock synchronization accuracy requirements and are set to be three times the average value of the accuracy or the standard deviation of the accuracy.

6. The master clock switching method based on network status according to claim 1, characterized in that: The link failure reported by the master clock node or the link failure reported by the backup master clock node includes: losing the delay request message of the adjacent important slave node, or knowing through the notification message that a slave clock node is lost for more than a preset time, and the preset time is set to be shorter than the refresh time of the important communication message.

7. The master clock switching method based on network status according to claim 1, characterized in that: When the master clock is working, if the link fault information reported by the master clock node and the slave clock node is inconsistent, the deviation information measured in the backup master clock domain maintained by the backup master clock is used as the judgment condition; If the master clock in the backup master clock domain does not receive a synchronization message within the preset time, or obtains one or more consecutive deviations greater than the first preset threshold from the clock node, or the deviation is not greater than the first preset threshold but exceeds the second preset threshold after accumulation within the preset time, it is considered a link failure.

8. The master clock switching method based on network status according to claim 1, characterized in that: When the backup master clock is working, if there is a contradiction between the link fault information reported by the backup master clock node and the slave clock node, the deviation information measured in the master clock domain maintained by the master clock is used as the judgment condition; If the backup master clock in the master clock domain does not receive a synchronization message within the preset time, or obtains one or more consecutive deviations greater than the first preset threshold from the clock node, or the deviation is not greater than the first preset threshold but exceeds the second preset threshold after accumulation within the preset time, it is considered a link failure.

9. The master clock switching method based on network status according to claim 1, characterized in that: If the number of master clock switching exceeds the preset number in the same scenario, it is considered that the same fault has been repeatedly triggered, and the master clock switching process is locked.

10. A master clock switching system based on network status, characterized in that: include: A first master clock switching module is used to switch to a backup master clock if a master clock node senses a link failure and reports it when the master clock is working; The second master clock switching module is used to switch to the master clock if a backup master clock node senses a link failure and reports it when the backup master clock is working; The third master clock switching module is used to determine whether the slave clock node is an important slave node when the slave clock node senses a link failure and reports it; If the slave clock node is an important slave node, determine whether the master clock is working or the backup master clock is working; If the main clock is working, switch to the backup main clock; If the backup master clock is working, switch to the master clock.

Images