A vehicle-mounted gptp clock redundancy system and method

Abstract

The application discloses a kind of vehicle-mounted gPTP clock redundancy system and method, and is deployed two time synchronization fields on each time synchronization node, and is deployed monitoring module except main node on other node;Main clock node sends time synchronization message in 0 field, other node receives 0 field time synchronization message;Standby main clock node sends 1 field time synchronization message after 0 field synchronization is completed;Each node monitoring module constantly detects 0 field time synchronization message forwarded by switch, detects whether 0 field main clock node is invalid;When standby main clock node detects that main clock node is invalid, it will stop the time of 0 field synchronization, and time synchronization message is issued in 1 field with its clock as reference;When slave node detects that main clock node is invalid, switch to 1 field and carry out time synchronization.The application can quickly detect main clock node failure by monitoring gPTP synchronization message characteristics, and quickly switch to standby clock field, reduce time synchronization interruption time.

Description

TECHNICAL FIELD

[0001] The present application relates to vehicle-mounted gPTP time synchronization technology, and in particular to a vehicle-mounted gPTP clock redundancy system and method. BACKGROUND

[0002] The vehicle-mounted gPTP time synchronization technology is a technology in which a master clock node forwards gPTP time synchronization messages through a switch to achieve time synchronization between multiple nodes. When the switch does not receive the gPTP messages of the master clock, the switch acts as the master clock and actively sends gPTP messages to downstream nodes. The prior art relies on the vehicle-mounted TSN switch to close the AS proxy function to detect the failure of the master clock node, but it cannot be compatible with the TSN switch that cannot close the AS proxy function. Moreover, most of the current vehicle-mounted TSN switches cannot close the AS proxy function, and the use scenario is limited. The redundancy relying on the TSN switch AS proxy function continues to synchronize by sending messages by the switch proxy. The performance of the switch clock is poorer than that of the master clock, which affects the synchronization accuracy. It is impossible to quickly detect the failure of the master clock node and implement smooth switching of the backup clock, which often leads to interruption of time synchronization or a significant decrease in accuracy, and cannot meet the high reliability requirements of vehicles. SUMMARY

[0003] To solve the problems in the prior art, the present application provides a vehicle-mounted gPTP clock redundancy system and method.

[0004] To achieve the purpose of the present application, the technical solution adopted by the present application is as follows:

[0005] A vehicle-mounted gPTP clock redundancy system comprises a master clock node, a backup master clock node, a slave clock node, and a switch. A monitoring module is deployed on the backup master clock node and the slave clock node.

[0006] Two time synchronization domains, 0 domain and 1 domain, are deployed on each time synchronization node. The master clock node sends time synchronization messages in the 0 domain, and other nodes receive the time synchronization messages in the 0 domain and synchronize the local time. The backup master clock node sends time synchronization messages in the 1 domain after synchronization in the 0 domain is completed.

[0007] The master clock node forwards gPTP time synchronization messages through the switch to achieve time synchronization between nodes. The monitoring module detects whether the 0 domain master clock node is invalid by monitoring the gPTP time synchronization messages forwarded by the switch. When the backup master clock node detects that the master clock node is invalid, it stops synchronizing the time in the 0 domain and uses its own clock as a reference to publish time synchronization messages in the 1 domain. When the slave node detects that the master clock node is invalid, it switches to the 1 domain to perform time synchronization.

[0008] Further, the monitoring module calculates a failure coefficient by monitoring changes in the time synchronization message and using a multi-parameter fusion adaptive filtering algorithm to identify whether the master clock node is failed.

[0009] A vehicle-mounted gPTP clock redundancy method, comprising the steps of:

[0010] Step one: deploy two time synchronization domains, 0 domain and 1 domain, on each time synchronization node of the vehicle, designate a master clock node and a backup master clock node, and deploy a monitoring module on each node except the master node;

[0011] Step two: the master clock node sends a time synchronization message in the 0 domain, and other nodes receive the time synchronization message in the 0 domain and synchronize the local time; the backup master clock node sends a time synchronization message in the 1 domain after synchronization in the 0 domain is completed;

[0012] Step three: the monitoring module of each node continuously detects the 0 domain time synchronization message forwarded by the switch and detects whether the 0 domain master clock node is failed;

[0013] Step four: when the backup master clock node detects that the master clock node is failed, it will stop synchronizing the time in the 0 domain and publish time synchronization messages in the 1 domain based on its own clock; when a slave node detects that the master clock node is failed, it will switch to the 1 domain for time synchronization.

[0014] Further, in step three, the monitoring module calculates a failure coefficient by monitoring changes in the time synchronization message and using a multi-parameter fusion adaptive filtering algorithm to identify whether the master clock node is failed.

[0015] Further, step three comprises the following steps:

[0016] (3.1) Monitor the following gPTP message features at the same time:

[0017] F1: Followup message timestamp field update, 0 or 1, 0 means update, 1 means no update;

[0018] F2: The degree of correction field cumulative value exceeding the normal range, 0~1, the larger the value represents the more exceeding the normal range;

[0019] F3: Sync message receiving interval stability, 0~1, the higher the value represents the better stability;

[0020] (3.2) Set the basic weight coefficients for each feature parameter: the weight coefficient of F1 is α1=0.4, the weight coefficient of F2 is α2=0.3, and the weight coefficient of F3 is α3=0.3;

[0021] (3.3) Establish a master clock state judgment model:

[0022] Compute the failure probability of F1-F3: P(failure) = α1 *F1 + α2* F2 + α3 *F3 Then the normal operation probability P(normal) = 1-P(failure);

[0023] (3.4) Establish a dynamic threshold Th according to network historical data statistics; normal network environment Th = 0.7, network frequent jitter environment Th = 0.8, network high load environment Th = 0.75;

[0024] (3.5) When P(failure)>Th, determine that the master clock node is invalid.

[0025] Further, the normal network environment: time synchronization Sync message transmission is stable, the receiving interval jitter rate <1%;

[0026] Network frequent jitter environment: time synchronization Sync message transmission is unstable, receiving interval jitter rate >= 1%;

[0027] High network load environment: other service traffic is greater than 90% bandwidth.

[0028] Further, the jitter rate calculation method:

[0029] Jitter rate = (std_dev_interval / mean_interval) * 100%

[0030] Where std_dev_interval represents the standard deviation of the receiving interval of the last N Sync messages; mean_interval represents the mean of the last N intervals;

[0031] mean_interval = sum(intervals) / N

[0032] std_dev_interval = sqrt( sum( (interval_i – mean_interval)^2 ) / (N-1) )

[0033] Where sum() represents the sum operation on the sequence of numbers in the parentheses, sqrt() represents the arithmetic square root operation on the numbers in the parentheses, interval_i represents the receiving interval of the i-th Sync message, and intervals represent the sequence composed of the last N Sync message receiving intervals.

[0034] The application has the advantages that, compared with the prior art, the application does not rely on the TSN Switch to close the AS agent function, is suitable for most current vehicle-mounted TSN Switches that cannot close the AS agent function, has a wide application scenario, and has strong compatibility. The application realizes redundancy through domain switching, does not rely on the clock source of the TSN Switch for synchronization, and ensures that high-precision time synchronization is maintained in the case of failure of the master clock. The application can quickly detect the failure of the master clock node by monitoring the characteristics of the gPTP synchronization message, and quickly switches to the standby clock domain, greatly reducing the time synchronization interruption time. The application uses a filtering algorithm to filter network jitter and other occasional abnormalities, has a low false positive rate, improves the accuracy of fault detection, and avoids unnecessary switching of the system. The standby master clock node of the application is kept in an active state in advance, and time synchronization does not need to be re-established when switching, ensuring time continuity. The application is a distributed decision, each node independently detects the failure of the master clock and makes a switching decision, avoiding the single-point failure that may be caused by centralized decision-making. The application does not need to change the existing gPTP protocol and hardware, only needs to add a monitoring module at the software level, and has low implementation cost. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a schematic diagram of the vehicle-mounted gPTP clock redundancy system described in the application;

[0036] Figure 2 is a flowchart of the vehicle-mounted gPTP clock redundancy method described in the application. DETAILED DESCRIPTION

[0037] The technical solutions of the application will be further described below in combination with the drawings and examples. The following examples are only used to more clearly illustrate the technical solutions of the application, and cannot be used to limit the protection scope of the application.

[0038] As shown in Figure 1 , the vehicle-mounted gPTP clock redundancy system described in the application includes a master clock node, a standby master clock node, a plurality of slave clock nodes, and a switch; and a monitoring module is deployed on the standby master clock node and the slave clock nodes.

[0039] Two time synchronization domains (0 domain and 1 domain) are deployed on each time synchronization node of the vehicle. The master clock node sends time synchronization messages in the 0 domain, and other nodes receive the time synchronization messages of the 0 domain and synchronize the local time. The standby master clock node sends 1 domain time synchronization messages after completing synchronization in the 0 domain. The monitoring module of each node continuously detects the time synchronization messages, detects whether the master clock node in the 0 domain is invalid, and when the standby master clock node detects that the master clock node is invalid, stops synchronizing the time of the 0 domain, and uses the clock itself as a reference to publish time synchronization messages in the 1 domain; when the slave node detects that the master clock node is invalid, switches to the 1 domain for time synchronization.

[0040] The master clock node forwards the gPTP time synchronization message through the switch to realize time synchronization among multiple nodes, the monitoring module monitors the gPTP time synchronization message forwarded by the switch to monitor whether the master clock node is invalid, realizes rapid detection of the master clock node fault, and realizes the master clock redundancy function by switching another domain to realize time synchronization.

[0041] As shown in Figure 2 The vehicle-mounted gPTP clock redundancy method provided by the application comprises the following steps:

[0042] Step 1: two time synchronization domains (0 domain and 1 domain) are deployed on each time synchronization node of the vehicle, a master clock node and a standby master clock node are designated, and a monitoring module is deployed on each node except the master node;

[0043] Step 2: the master clock node sends a time synchronization message in the 0 domain, and other nodes receive the time synchronization message in the 0 domain and synchronize the local time; after the standby master clock node completes synchronization in the 0 domain, it sends a time synchronization message in the 1 domain;

[0044] Step 3: the monitoring module of each node continuously detects the 0 domain time synchronization message forwarded by the switch to detect whether the 0 domain master clock node is invalid;

[0045] Each node independently detects the master clock fault and makes a switching decision to realize distributed decision-making, avoiding the single point fault that may be caused by centralized decision-making.

[0046] When the switch node receives the time synchronization message sent by the master clock node, it will update the timestamp field in the Followup message and normally update the correction field to send it out; when the switch does not receive the time synchronization message sent by the master clock node, the switch will not update the timestamp field in the Followup message, but will add the time to the correction field and send it out.

[0047] The monitoring module identifies whether the master clock node is invalid by monitoring the change of the time synchronization message, and applies a filtering algorithm to filter occasional abnormalities to improve the identification accuracy and prevent false positives.

[0048] Since the switch judges whether the upstream master clock node is invalid according to a certain timeout time (such as 125 ms), it autonomously sends a time synchronization message; if the occasional timeout caused by network jitter causes the downstream node to frequently switch the clock domain, it will cause clock oscillation, so it is necessary to filter the behavior of the switch that actively sends the time synchronization message caused by network jitter.

[0049] Through the filtering algorithm described below, the failure coefficient can be calculated by comprehensively considering the network situation, and whether the master clock node is failed can be judged by judging whether the failure coefficient is greater than the set threshold.

[0050] The multi-parameter fusion adaptive filtering algorithm is applied to gPTP message feature detection, specifically including:

[0051] (3.1) Monitor the following multiple gPTP message features at the same time:

[0052] F1: Followup message timestamp field update, 0 or 1, 0 means update, 1 means no update; only when two consecutive periods are not updated, F1 will be set to 1 to filter out transient abnormalities;

[0053] F2: The degree of correction field cumulative value exceeding the normal range, 0~1, the larger the value represents the more exceeding the normal range;

[0054] F3: Stability of Sync message receiving interval, 0~1, the higher the value represents the better stability.

[0055] (3.2) Set the basic weight coefficient for each feature parameter: the weight coefficient of F1 is α1=0.4, the weight coefficient of F2 is α2=0.3, and the weight coefficient of F3 is α3=0.3;

[0056] If F1 is 1 and F3>=0.7 (stable + F1 abnormal → high probability of failure): α1=1.2 (amplify F1 contribution); α3=0.8 (slightly reduce F3 to lower effect);

[0057] If F1 is 1 and F3<0.5 (unstable + F1 abnormal → not sure to fail): α1=0.7 (reduce F1); α3=1.1 (slightly increase F3 to push up the effect, but combined with continuous filtering to reduce false positives);

[0058] Other conditions: the weight remains unchanged.

[0059] (3.3) Establish a master clock state judgment model:

[0060] Calculate the failure probability of F1-F3: P(failure) = α1 *F1 + α2* F2 + α3 *F3， Then the normal operation state probability P(normal) = 1-P(failure).

[0061] (3.4) Establish a dynamic threshold Th according to network historical data statistics; normal network environment Th=0.7, network jitter frequent environment Th=0.8, network load high environment Th=0.75;

[0062] Network state is mainly based on time synchronization Sync message, when Switch timeout does not receive Sync message (network jitter causes Sync message receiving not timely) will actively send time synchronization message to downstream nodes, at this time will cause the jitter of downstream Sync message receiving interval (the jitter of Sync message receiving in this scenario is ms level).

[0063] Normal network environment: time synchronization Sync message transmission is stable, receiving interval jitter rate <1%;

[0064] Network frequent jitter environment: time synchronization Sync message transmission is unstable, leading to Switch frequent timeout, receiving interval jitter rate >=1%;

[0065] High network load environment: other service traffic is greater than 90% bandwidth.

[0066] Jitter rate calculation method:

[0067] Jitter rate = (std_dev_interval / mean_interval) * 100%

[0068] Wherein, std_dev_interval represents the standard deviation of the last N Sync message receiving interval (unit: ms); mean_interval represents the mean of the last N interval.

[0069] mean_interval = sum(intervals) / N

[0070] std_dev_interval = sqrt( sum( (interval_i – mean_interval)^2 ) / (N-1) )

[0071] Wherein, sum() represents the sum operation of the numerical sequence in the parentheses, sqrt() represents the arithmetic square root operation of the numerical value in the parentheses, interval_i represents the receiving interval of the i-th Sync message (unit: ms), intervals represents the sequence composed of the last N Sync message receiving intervals (each element is a single interval value, unit: ms).

[0072] (3.5) When P(failure)>Th, determine that the master clock node fails.

[0073] Step four: when the standby master clock node detects that the master clock node fails, it will stop synchronizing the time of 0 domain, and take its own clock as the reference to publish time synchronization message in 1 domain; when the slave node detects that the master clock node fails, it will switch to 1 domain to perform time synchronization.

[0074] The standby master clock node is kept in an active state in advance, so that time synchronization does not need to be re-established when switching, and time continuity is ensured.

[0075] The application has the advantages that, compared with the prior art, the application does not rely on TSN Switch to close the AS agent function, is suitable for most current vehicle-mounted TSN Switches that cannot close the AS agent function, has a wide application scenario, and has strong compatibility. The application realizes redundancy through domain switching, does not rely on the clock source of the TSN Switch for synchronization, and ensures that high-precision time synchronization is maintained in the case of master clock failure. The application can quickly detect master clock node failure by monitoring the characteristics of gPTP synchronization messages, and quickly switches to a standby clock domain, greatly reducing the time synchronization interruption time. The application uses a filtering algorithm to filter network jitter and other occasional abnormalities, has low false positive rate, improves fault detection accuracy, and avoids unnecessary switching of the system. The standby master clock node is kept in an active state in advance, so that time synchronization does not need to be re-established when switching, and time continuity is ensured. The application is a distributed decision, each node independently detects master clock failure and makes a switching decision, avoiding the single-point failure that may be caused by centralized decision-making. The application does not need to change the existing gPTP protocol and hardware, only needs to add a monitoring module at the software level, and has low implementation cost.

[0076] The applicant of the present application has made a detailed description and explanation of the embodiments of the present application in combination with the drawings of the specification, but those skilled in the art should understand that the above embodiments are only preferred embodiments of the present application, and the detailed description is only to help the reader better understand the spirit of the present application, and is not a limitation on the protection scope of the present application. On the contrary, any improvement or modification based on the spirit of the present application should fall within the protection scope of the present application.

Claims

1. A vehicle-mounted gPTP clock redundancy method, characterized in that: Including steps: Step 1: Deploy two time synchronization domains, domain 0 and domain 1, on each time synchronization node in the vehicle, designate a master clock node and a backup master clock node, and deploy monitoring modules on all nodes except the master node. Step 2: The master clock node sends a time synchronization message in domain 0. Other nodes receive the time synchronization message from domain 0 and synchronize their local time. After domain 0 synchronization is complete, the backup master clock node sends a time synchronization message in domain 1. Step 3: The monitoring module of each node continuously detects the domain 0 time synchronization messages forwarded by the switch to detect whether the domain 0 master clock node has failed; The monitoring module monitors changes in time synchronization messages and uses a multi-parameter fusion adaptive filtering algorithm to calculate the failure coefficient and identify whether the master clock node has failed. Specific steps: (3.1) Simultaneously monitor the following gPTP message characteristics: F1: Update status of the Followup message timestamp field, 0 or 1, 0 indicates update, 1 indicates no update; F2: The degree to which the cumulative value of the correction field exceeds the normal range, ranging from 0 to 1. The larger the value, the more it exceeds the normal range; F3: Sync message receiving interval stability, 0~1, the higher the value, the better the stability; (3.2) Set the basic weight coefficients for each feature parameter: the weight coefficient of F1 is α1=0.4, the weight coefficient of F2 is α2=0.3, and the weight coefficient of F3 is α3=0.3; (3.3) Establish the master clock status judgment model: Calculate the failure probability of F1-F3: P(failure) = α1 *F1 + α2* F2 + α3 *F3 , then the probability of normal operation state P(normal) = 1-P(failure); (3.4) Establish a dynamic threshold Th based on historical network data statistics; in a normal network environment, Th = 0.7; in an environment with frequent network jitter, Th = 0.8; and in an environment with high network load, Th = 0.75; (3.5) When P(failure) > Th, the master clock node is considered failed; Step 4: When the backup master clock node detects that the master clock node has failed, it stops synchronizing the time in Domain 0 and uses its own clock as the reference to send time synchronization messages in Domain 1. When the slave node detects that the master clock node has failed, it switches to Domain 1 for time synchronization.

2. The vehicle-mounted gPTP clock redundancy method according to claim 1, wherein Normal network environment: Time synchronization Sync message transmission is stable, and the receiving interval jitter rate is < 1%; Frequent network jitter: Time synchronization Sync message transmission is unstable, and the receiving interval jitter rate is greater than or equal to 1%. High network load environment: Other business traffic exceeds 90% of the bandwidth.

3. The vehicle-mounted gPTP clock redundancy method according to claim 2, wherein: Jitter rate calculation method: Jitter rate = (std_dev_interval / mean_interval) * 100% Where std_dev_interval represents the standard deviation of the last N Sync message reception intervals; mean_interval represents the mean of the last N intervals; mean_interval = sum(intervals) / N std_dev_interval = sqrt( sum( (interval_i – mean_interval)^2 ) / (N-1) ) In the parameter, sum() represents the sum of the numeric sequence in the brackets, sqrt() represents the square root operation of the numeric sequence in the brackets, interval_i represents the reception interval of the i-th Sync message, and intervals represents the sequence of the most recent N Sync message reception intervals.

4. A vehicle-mounted gPTP clock redundancy system, used to implement the vehicle-mounted gPTP clock redundancy method according to any one of claims 1 to 3, characterized in that: It includes a master clock node, a backup master clock node, a slave clock node, and a switch; monitoring modules are deployed on the backup master clock node and the slave clock node; Two time synchronization domains, domain 0 and domain 1, are deployed on each time synchronization node. The master clock node sends time synchronization messages in domain 0. Other nodes receive time synchronization messages from domain 0 and synchronize their local time. After domain 0 synchronization is complete, the backup master clock node sends time synchronization messages to domain 1. The master clock node forwards gPTP time synchronization messages through the switch to achieve time synchronization between nodes. The monitoring module detects whether the master clock node in Domain 0 has failed by monitoring the gPTP time synchronization messages forwarded by the switch. When the backup master clock node detects that the master clock node has failed, it stops synchronizing the time in Domain 0 and publishes time synchronization messages in Domain 1 based on its own clock. When the slave node detects that the master clock node has failed, it switches to Domain 1 for time synchronization.

5. The vehicle-mounted gPTP clock redundancy system according to claim 4, characterized in that: The monitoring module monitors the changes in time synchronization messages and uses a multi-parameter fusion adaptive filtering algorithm to calculate the failure coefficient and identify whether the master clock node has failed.

Images