Consistency voting method and device for multi-source time synchronization data

Abstract

The invention discloses a consistency voting method and device for multi-source time synchronization data, and relates to the technical field of high-reliability time synchronization of avionics, time sensitive networks and the like. The method comprises the following steps: respectively acquiring synchronous data including local capture time, original time deviation and cumulative frequency ratio from a plurality of independent clock sources to obtain corresponding clock source data; performing validity screening on the clock source data; extrapolating the original time deviation of each effective clock source to a set voting moment based on the cumulative frequency ratio to obtain a projection time deviation; based on all projection time deviations, determining an internally consistent credible clock source subset through bounded closure consistency verification; and according to the verification result and the redundancy condition, calculating and outputting system time correction or executing degradation output. According to the method, false deviation caused by asynchronous sampling can be eliminated, deterministic fault isolation and fault-tolerant voting are realized, and the output safety and reliability of the system in a high-safety-requirement scene are guaranteed.

Description

Technical Field

[0001] This invention relates to a consensus voting method and apparatus for multi-source time synchronization data, belonging to the field of high-reliability time synchronization technology such as avionics and time-sensitive networks. Background Technology

[0002] In high-safety-level systems such as avionics and autopilot controllers, terminal devices typically employ multi-mode redundancy architectures to meet high reliability requirements, simultaneously tracking three or more independent master clock sources. The fault-tolerant timing management entity within the terminal device needs to monitor the health status of these clock sources in real time, identify and eliminate faulty sources through consensus voting algorithms, and calculate the optimal system time. However, existing technologies for implementing multi-source redundancy voting have the following drawbacks: For example, asynchronous sampling suffers from time-domain misalignment: due to network queuing delays and protocol stack scheduling jitter, the arrival times of data from different clock sources are discrete. Directly comparing data collected at different times introduces spurious errors caused by local clock drift. Existing methods often lack strict constraints on the "freshness" of sampled data. If data from a certain channel has not been updated for a long time, directly using outdated data for maintenance or extrapolation will amplify accumulated errors over time. Existing standards only focus on the calibration of a single link, failing to "normalize" multi-channel asynchronously acquired data to the same physical time for fair comparison. Summary of the Invention

[0003] The purpose of this invention is to provide a method and apparatus for consensus voting of multi-source time-synchronized data. By projecting the asynchronous clock source data from multiple sources to a unified voting time, the deviation introduced by local clock drift is eliminated. Combined with dual validity screening and the use of bounded closure consistency verification to isolate and vote on faults, the system output is guaranteed to be safe and reliable.

[0004] To achieve the above objectives, the present invention is implemented using the following technical solution.

[0005] On one hand, the present invention provides a consensus voting method for multi-source time synchronization data, comprising:

[0006] Time synchronization data is collected from multiple independent clock sources to obtain corresponding clock source data, wherein the clock source data includes at least the local capture time, the original time deviation, and the cumulative frequency ratio;

[0007] The validity of each clock source data is filtered to obtain valid clock source data;

[0008] Based on the cumulative frequency ratio of each valid clock source data, the original time deviation is extrapolated to the set voting time to obtain the corresponding projected time deviation;

[0009] Based on all projected time deviations, a subset of internally consistent and reliable clock sources is determined through bounded closure consistency verification.

[0010] If the subset of trusted clock sources is verified to converge and meets the preset redundancy condition, the system time correction amount is calculated and output based on the projected time deviation of all clock sources in the subset; otherwise, the system time correction amount is output according to the preset degradation strategy.

[0011] Optionally, the time synchronization data collected includes:

[0012] When a synchronization message is received from a clock source, a unique sampling identifier is generated for this acquisition, and the local acquisition time, raw time deviation and cumulative frequency ratio obtained in this acquisition are bound in an atomic operation to ensure that the data originates from the same physical event.

[0013] Optionally, the validity screening includes:

[0014] If the time difference between the voting time and the local capture time does not exceed the preset maximum extrapolation window, and the cumulative frequency ratio is within the preset confidence interval, then the corresponding clock source data is determined to be valid; otherwise, it is determined to be invalid.

[0015] Optionally, the bounded closure consistency check includes:

[0016] Based on the projected time deviation of all valid clock sources, a relation matrix is ​​constructed to characterize whether any two clock sources are consistent, wherein this matrix is ​​constructed only once in the current voting period;

[0017] The global support of each clock source is calculated based on the relationship matrix, and the clock source with the highest global support is selected as the seed clock source.

[0018] An initial candidate set is constructed using the seed clock source and other clock sources that are consistent with it, and the internal support of each member in the candidate set is calculated.

[0019] Add members whose internal support is less than the current number of members minus one to the queue for review.

[0020] Within the preset maximum number of removals, the removal operation is performed iteratively:

[0021] Take a clock source from the queue to be reviewed. If its internal support is less than the number of members in the current candidate set minus one, remove it from the candidate set and incrementally update the internal support of the remaining members based on the relation matrix. Add members whose updated internal support is less than the number of members in the current candidate set minus one and who are not in the queue to the queue to be reviewed.

[0022] When the queue to be reviewed is empty, the iteration is terminated. At this time, the candidate set is the subset of the trusted clock source, and the verification is determined to be converged. If the queue to be reviewed is still not empty when the maximum number of eliminations is reached, the verification is determined to be unconverged.

[0023] Optionally, when constructing the relationship matrix, if the absolute value of the difference between the projected time deviations of the two clock sources is less than a preset consistency threshold, then the two are determined to be consistent.

[0024] Wherein, the consistency threshold is not less than the upper bound of the measurement noise estimation based on the time synchronization protocol or the measurement noise basis obtained through offline calibration.

[0025] Optionally, in bounded closure consistency verification, a first-in-first-out queue is used to manage the clock sources to be verified, and a status flag is set for each clock source to ensure that it is processed at most once in a voting cycle.

[0026] Optionally, when the global support of multiple clock sources is the same at the maximum value, the clock source with the smallest channel number is selected as the seed clock source.

[0027] Optionally, the system time correction is calculated and output based on a subset of trusted clock sources, using a weighted average of the projected time deviations of each clock source within the subset of trusted clock sources.

[0028] The weights are configured as either equal weights or based on the historical measurement quality of each clock source.

[0029] Optionally, the degradation strategy includes:

[0030] Reuse the system time correction amount output from the previous valid voting cycle, or output the correction amount calculated based on a preset backup clock source.

[0031] In a second aspect, the present invention provides a computer device, comprising:

[0032] Memory, used to store computer programs / instructions;

[0033] A processor for executing the computer program / instructions to implement the steps of the consensus voting method for multi-source time synchronization data as described in any one of the first aspects.

[0034] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0035] This invention employs two core mechanisms: time-domain projection alignment and bounded closure consistency verification. By utilizing frequency ratios to precisely compensate data from each channel to the same time, it achieves fair comparison and solves the problem of unfair direct comparison of multi-source data caused by local clock drift. Furthermore, by calculating support and performing bounded iterative elimination, a reliable subset of internally consistent data is selected, achieving accurate fault isolation. This invention also combines atomic data binding, validity filtering, and security degradation strategies, significantly improving the robustness and reliability of the system while ensuring high-precision time synchronization. It has particular application value in fields such as avionics. Attached Figure Description

[0036] Figure 1 This is a schematic flowchart of a consensus voting method for multi-source time synchronization data provided in an embodiment of the present invention.

[0037] Figure 2 This diagram illustrates a comparison between the temporal projection strategy provided in this embodiment of the invention and the traditional zero-order preservation strategy. Detailed Implementation

[0038] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0039] Example 1

[0040] This embodiment introduces a consensus voting method for multi-source time synchronization data, using a fault-tolerant timing management software module of an avionics terminal device as the implementation environment. The terminal device includes a network interface controller for receiving synchronization messages from each channel. Logically, the module can be divided into functional sub-modules such as acquisition, filtering, projection, voting, and mode switching. The terminal tracks three master clock sources conforming to the IEEE 802.1AS standard through three independent network channels (channel 0, channel 1, and channel 2), forming a triple-modal redundant clock synchronization architecture. The overall process of the method is as follows: Figure 1 As shown, the specific steps are as follows:

[0041] S1. Asynchronous measurement data acquisition and atomic binding:

[0042] When any network interface controller receives a synchronization message from channel i (i=0, 1, 2) and generates an interrupt, the interrupt service routine (ISR) or protocol stack task is triggered to perform data acquisition.

[0043] The data acquisition process needs to ensure the spatiotemporal atomicity of the data, specifically by generating a unique sampling identifier for this acquisition event. This identifier can be a monotonically increasing global counter value within the protocol stack, or it can directly use the local timestamp when the message arrived. Within the same interrupt or task context, the following three pieces of data are consistently read and recorded:

[0044] Local capture time : The local free-run counter value at the time of arrival of the synchronization message.

[0045] Original time deviation : Measurement deviation value directly output by the time synchronization protocol stack (master and slave clock).

[0046] Cumulative frequency ratio The ratio of the master clock frequency to the local clock frequency, i.e. .

[0047] Combine the above three data points with Atomic binding is performed to form a complete sampling record structure. To prevent data from being updated by background tasks in the protocol stack during the reading process, a version number dual-read mechanism (Seqlock) can be used. For example, the version number is recorded before reading. Record the version number after reading. ,like or If a write operation is initiated, the read operation is retried to ensure that the sampled records strictly correspond to the same physical moment. The read process can be combined with memory barriers or atomic read / write semantics to ensure consistent read / write order.

[0048] S2. Determine the unified voting time and perform validity screening:

[0049] The system's fault-tolerant timing task is woken up by a periodic scheduler, such as a periodic task in a real-time operating system. Its period can be set to milliseconds. After the task starts:

[0050] Immediately retrieve the current local time counter value, freeze it, and define it as the unified voting moment for this voting cycle. This moment is independent of all asynchronous message arrival events.

[0051] Subsequently, the data collected from all channels underwent dual validity preprocessing:

[0052] Timeliness constraint: Define aging time Set the maximum allowed extrapolation window. ,like If the data in that channel is deemed outdated, it will be marked as invalid for the current period. The setting must be based on the system's maximum allowable projection error. The worst physical drift upper bound of the frequency ratio offset by 1 :satisfy For example, if the maximum projection error is required The expected frequency offset is no more than 100 ns, and the worst physical upper bound of the offset by 1 is 50 ppm. =5e-5), then It should not exceed 2ms.

[0053] Frequency ratio confidence interval constraint:

[0054] Check cumulative frequency ratio Is it within the preset trusted zone? Inside the room, The value can be determined comprehensively based on the physical characteristics of the crystal oscillator (tolerance, temperature drift). If the frequency of the channel is abnormal, it will be marked as invalid.

[0055] Only when channel data simultaneously satisfies both of the above constraints is it marked as a valid channel and included in the set of valid clock sources for subsequent calculations in this cycle, with the number of members set to [value missing]. (≤3).

[0056] S3. Perform projection alignment calculation:

[0057] For each channel i in the valid set, perform a first-order linear projection and use its recorded cumulative frequency ratio to obtain its original time deviation. Linear extrapolation (projection) to a unified voting time Calculate its projection deviation at the moment of unified voting. :

[0058]

[0059] in, and Both are local timescales under the same time base, and are expressed in the same units; projection items and They have the same time dimension.

[0060] The core value of this step lies in the fact that by introducing a frequency ratio as a slope factor for first-order compensation, it offsets the drift error accumulated due to the local clock frequency offset between the asynchronous arrival of the message and the unified voting time. This aligns the deviation data of all valid channels to the same physical moment for fair comparison, achieving time-domain alignment of the data. Figure 2 As shown, this paper compares the performance of the zero-order hold strategy of the conventional method with the unified time-domain projection strategy of the present invention in the presence of local clock drift.

[0061] The horizontal axis represents local time (in nanoseconds), and the vertical axis represents the measured clock offset. The figure shows the local acquisition time (sampling time) of three asynchronously arriving clock source samples: channel 0 (source A), channel 1 (source B), and channel 2 (source C). They are all different.

[0062] Dashed path (existing technology): Represents the traditional direct lateral comparison method. This method ignores the sampling to voting time. The local clock drift accumulates during this period, which is equivalent to zero-order hold. As shown in the figure, in On the cross section, the three dashed lines show a significant divergence. This is not an error of the source itself, but a "spurious bias" introduced by asynchronous sampling.

[0063] Solid line path (in this scheme): represents the path based on cumulative frequency ratio. The projection trajectory. This invention utilizes the formula Linear compensation is performed. As shown in the figure, through slope correction, the three solid lines... Precise convergence of time eliminates drift errors during the waiting period and restores the true physical consistency of each clock source.

[0064] S4. Bounded closure consistency verification and trusted subset determination:

[0065] This step is about... Among the valid clock sources, find the largest subset that is mutually consistent and use it as the trusted clock source subset, and isolate the faulty source.

[0066] S41. Construct a consistency relation matrix :

[0067] Build a A symmetric matrix G is given by the following expression for any two sources i and j in the valid set:

[0068] Calculate the difference in projection deviation: If the difference in projection bias is less than the consistency threshold... ,but This indicates that i and j observe the same thing at this moment; otherwise, , indicating inconsistency.

[0069] In this case, the diagonal elements of the matrix are defined as 0. And is a symmetric matrix, satisfying .

[0070] This matrix is ​​constructed only once during the voting cycle, and all subsequent operations reuse this matrix. This is the key to controlling the complexity of the algorithm.

[0071] threshold Setting: Satisfy ,in The measurement noise baseline is obtained from the upper bound of the protocol stack measurement noise estimation or the upper bound of the offline calibration. Additionally, a consistency threshold is considered. The settings also need to take into account the maximum extrapolation window. Introduced projection error It should meet the following requirements. This is to prevent normal projection errors caused by local clock drift from being misjudged as faults.

[0072] S42. Calculate global support and select a seed clock source:

[0073] Calculate the global support for each valid source. The source with the highest support is selected as the "seed clock source". If there are multiple maximum support values, the one with the smallest channel number is selected to ensure the determinism of the algorithm.

[0074] S43. Construct a candidate set and perform bounded closure verification: using the seed clock source and its position in the matrix... All neighbors construct candidate sets A bounded closure check is performed on the candidate set, and the number of eliminations during the closure check does not exceed a preset fixed number. And satisfy The specific steps are as follows:

[0075] Construct the initial candidate set C: Add the seed clock source and all other sources that are consistent with the seed clock source to set C.

[0076] Initialize internal support: For each member u in C, calculate its internal support. ,in, This calculation is performed only once within the cycle.

[0077] Bounded elimination loop: Initialize a first-in-first-out (FIFO) queue Q to be reviewed. To avoid duplicate members being enqueued, set and maintain an enqueue flag. If and only if And member u satisfies When that time, add it to set Q and set it to... 1. This ensures that each member joins the queue at most once within the same voting cycle. This indicates the number of members in the current candidate set C.

[0078] Set a removal operation counter, remove_count, initially set to 0, with a maximum value of [value missing]. .

[0079] Loop condition: When Q is not empty and remove_count < At that time, execute:

[0080] Remove a member u from the Q queue;

[0081] Check whether the current C still satisfies ; if it does, remove u from C;

[0082] For each remaining member v in C, perform an incremental update: ;

[0083] Here, incremental update is adopted instead of recalculating the entire matrix because removing a node only affects the count of the edges associated with it. This processing method avoids recalculating the full support degree for all remaining nodes, thus significantly reducing the computational complexity of the algorithm in a single iteration and ensuring real-time performance.

[0084] Check each updated v, if its , then add it to the queue Q and set the flag .

[0085] Loop termination:

[0086] When the queue is empty, at this time all members in the candidate set C satisfy , that is, any member in the set is consistent with other members, and C is a subset of reliable clock sources.

[0087] When remove_count reaches , but the queue Q is still not empty, it is determined that the closure check has not converged, and the reliable subset cannot be determined in this cycle.

[0088] S5. Output decision and mode switching:

[0089] Normal output mode: If the closure check converges and finally ≥M_min, where M_min is the preset minimum redundancy, usually 2. Then it is considered that the system has enough sources with good consistency. At this time, calculate the weighted average of the projection deviations of all sources in C as the final system time correction amount for this cycle. The weighting strategy can be: equal-weight average / quality-based weight (the weight is proportional to the reciprocal of the historical measurement variance of each source).

[0090] Degraded output (hold) mode:

[0091] If any of the following situations occur: the closure check does not converge, the closure check converges but <M_min, after validity screening =0 (no valid sources), then the system enters the hold mode, and the output strategy is:

[0092] Preferentially reuse the system time correction amount calculated and output in the previous valid voting cycle.

[0093] If there is no previous valid voting cycle, the output is a correction amount calculated based on a preset, highly reliable backup clock source.

[0094] At the same time, the system generates a hold status flag to notify the upper-layer application that the current time synchronization system is in a degraded operation state.

[0095] Assuming that in a certain voting period, all data from the three channels are valid after validity screening ( =3). The data is shown in Table 1 (time unit: nanosecond):

[0096] Table 1 Channel Data

[0097]

[0098] The execution process of step S4 is as follows:

[0099] S41. Construct a consistency relation matrix: Set a consistency threshold ε = 100 ns, and calculate the absolute value of the difference between pairwise projection biases:

[0100] Therefore, channels 0 and 1 are consistent.

[0101] Therefore, channels 0 and 2 are inconsistent.

[0102] Therefore, channels 1 and 2 are inconsistent.

[0103] Based on this, a symmetric relation matrix G is constructed, where 1 represents consistency, 0 represents inconsistency, and the diagonal is 0;

[0104] ;

[0105] S42. Determine the seed clock source: Calculate the global support of each channel, which is the sum of the off-diagonal elements in each row of matrix G;

[0106] Channel 0 support: 1;

[0107] Channel 1 support: 1;

[0108] Channel 2 support: 0;

[0109] Choose channel 0, which has the highest support and the smallest number, as the seed clock source.

[0110] S43. Perform bounded closure verification:

[0111] Construct an initial candidate set C = {0, 1} using seed channel 0 and its consistent neighbor channel 1;

[0112] Calculate the internal support of members within the set: Channel 0 has a support of 1 within C, Channel 1 has a support of 1 within C, the current candidate set has 2 members |C|, and the internal consistency condition requires the member support to satisfy... Both Channel 0 and Channel 1 meet the condition, so there is no need to remove any members. The queue to be reviewed is empty, and the verification is pending convergence.

[0113] The final subset of reliable clock sources is as follows The number of members is 2.

[0114] Step S5, Output Decision:

[0115] Since the bounded closure verification converges and the number of members in the reliable subset |C|=2, the minimum redundancy requirement is satisfied. The system then enters normal output mode.

[0116] Output: The average projection deviation of channels 0 and 1 is calculated as (170+135) / 2 = 152.5 ns as a correction. Channel 2 is identified as the fault source and isolated.

[0117] Example 2

[0118] Based on the same inventive concept as Embodiment 1, this embodiment provides four channels i (i=0, 1, 2, 3) to illustrate the cases that need to be eliminated in closure verification. Within a certain voting period, the data from all four clock sources passed the validity screening, and the projection time deviation of each channel is as follows:

[0119] Channel 0: 100ns;

[0120] Channel 1: 105 ns;

[0121] Channel 2: 110 ns;

[0122] Channel 4: 190ns (potential source of failure).

[0123] Given a consistency threshold ε = 10ns and a minimum redundancy... Maximum number of removals =4.

[0124] S41. Calculate the absolute value of the difference between pairwise projection deviations:

[0125] |100 - 105| = 5 ns < 10 ns → Channels 0 and 1 are consistent;

[0126] |100 - 110| = 10 ns = 10 ns → Channels 0 and 2 are inconsistent;

[0127] |100 - 190| = 90 ns > 10 ns → Channels 0 and 3 are inconsistent;

[0128] |105 - 110| = 5 ns < 10 ns → Channels 1 and 2 are consistent;

[0129] |105 - 190| = 85 ns > 10 ns → Channels 1 and 3 are inconsistent;

[0130] |110 - 190| = 80 ns > 10 ns → Channels 2 and 3 are inconsistent;

[0131] Construct a symmetric matrix G

[0132] ;

[0133] S42. Calculate global support and select a seed clock source:

[0134] Channel 0 has a support of 1, Channel 1 has a support of 2, Channel 2 has a support of 1, and Channel 3 has a support of 0.

[0135] Choose channel 1, which has the highest support, as the seed clock source.

[0136] S43. Construct an initial candidate set and perform bounded closure verification:

[0137] C = {0, 1, 2};

[0138] Calculate the internal support. The internal support of channel 0 is 1, the internal support of channel 1 is 2, and the internal support of channel 2 is 1. Currently, |C|=3. The requirement is that the internal support ≥ |C|-1=2. Channels 0 and 2 are removed and added to the queue to be reviewed.

[0139] First removal: Take out channel 0, check its support = 1 < 2, remove it from C, update C = {1, 2}, update its internal support, channel 1: the original support 2 minus the consistency relationship with 0, the current internal support is 1, and the support of channel 2 is still 1.

[0140] Second elimination: Channel 2 is removed. Its internal support is 1 < |C| - 1 = 1, which is not true, so it is not eliminated.

[0141] Finally, the reliable clock subset C={1,2} is obtained, which satisfies the minimum redundancy condition, and the output time correction is (105+110) / 2=107.5ns.

[0142] Example 3

[0143] Based on the same inventive concept as other embodiments, this embodiment introduces a computer device deployed in an avionics terminal device. This device physically constitutes a fault-tolerant time synchronization management module. During aircraft flight, the device receives synchronization signals from an external master clock source through three independent network channels and runs the method in Embodiment 1 to achieve highly reliable time synchronization.

[0144] The processor of this computer device is an onboard multi-core CPU (such as the ARM Cortex-R series) that supports real-time operation. The memory includes a matching Flash memory and SRAM. The Flash memory stores the computer program that implements the method described in Embodiment 1, and the SRAM is used to store temporary variables such as acquired data and relational matrices during runtime.

[0145] The method described in Example 1 is implemented by the processor executing the stored program. The specific process will not be described in detail. The device can successfully identify the source of the fault and output a reliable time correction based on the internal consistent channel. It can automatically and reliably execute complex multi-source fault-tolerant timing logic at the hardware level, thereby improving the safety and reliability of the entire avionics system.

[0146] In summary, the present invention can accurately identify and isolate fault sources with significant deviations from multiple clock sources, ensuring that the system outputs reliable results based on internally consistent healthy sources. It realizes a closed loop from data acquisition, validity screening, projection alignment, consistency verification to final decision output. While ensuring high-precision time synchronization, it significantly improves the robustness and reliability of the system, and has certain application value, especially in the fields of avionics.

[0147] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0151] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A consensus voting method for multi-source time-synchronized data, characterized in that, include: Time synchronization data is collected from multiple independent clock sources to obtain corresponding clock source data, wherein the clock source data includes at least the local capture time, the original time deviation, and the cumulative frequency ratio; The validity of each clock source data is filtered to obtain valid clock source data; Based on the cumulative frequency ratio of each valid clock source data, the original time deviation is extrapolated to the set voting time to obtain the corresponding projected time deviation; Based on all projected time deviations, a subset of internally consistent and reliable clock sources is determined through bounded closure consistency verification. If the subset of trusted clock sources is verified to converge and meets the preset redundancy condition, the system time correction amount is calculated and output based on the projected time deviation of all clock sources in the subset; otherwise, the system time correction amount is output according to the preset degradation strategy.

2. The consensus voting method for multi-source time synchronization data according to claim 1, characterized in that, The time-synchronized data collected includes: When a synchronization message is received from a clock source, a unique sampling identifier is generated for this acquisition, and the local acquisition time, raw time deviation and cumulative frequency ratio obtained in this acquisition are bound in an atomic operation to ensure that the data originates from the same physical event.

3. The consensus voting method for multi-source time synchronization data according to claim 1, characterized in that, The validity screening includes: If the time difference between the voting time and the local capture time does not exceed the preset maximum extrapolation window, and the cumulative frequency ratio is within the preset confidence interval, then the corresponding clock source data is determined to be valid; otherwise, it is determined to be invalid.

4. The consensus voting method for multi-source time synchronization data according to claim 1, characterized in that, The bounded closure consistency check includes: Based on the projected time deviation of all valid clock sources, a relation matrix is ​​constructed to characterize whether any two clock sources are consistent, wherein this matrix is ​​constructed only once in the current voting period; The global support of each clock source is calculated based on the relationship matrix, and the clock source with the highest global support is selected as the seed clock source. An initial candidate set is constructed using the seed clock source and other clock sources that are consistent with it, and the internal support of each member in the candidate set is calculated. Add members whose internal support is less than the current number of members minus one to the queue for review. Within the preset maximum number of removals, the removal operation is performed iteratively: Take a clock source from the queue to be reviewed. If its internal support is less than the number of members in the current candidate set minus one, remove it from the candidate set and incrementally update the internal support of the remaining members based on the relation matrix. Add members whose updated internal support is less than the number of members in the current candidate set minus one and who are not in the queue to the queue to be reviewed. When the queue to be reviewed is empty, the iteration is terminated. At this time, the candidate set is the subset of the trusted clock source, and the verification is determined to be converged. If the queue to be reviewed is still not empty when the maximum number of eliminations is reached, the verification is determined to be unconverged.

5. The consensus voting method for multi-source time synchronization data according to claim 4, characterized in that, When constructing the relationship matrix, if the absolute value of the difference between the projection time deviations of two clock sources is less than a preset consistency threshold, then the two are determined to be consistent. Wherein, the consistency threshold is not less than the upper bound of the measurement noise estimation based on the time synchronization protocol or the measurement noise basis obtained through offline calibration.

6. The consensus voting method for multi-source time synchronization data according to claim 4, characterized in that, In bounded closure consistency verification, a first-in-first-out queue is used to manage the clock sources to be verified, and a status flag is set for each clock source to ensure that it is processed at most once in a voting cycle.

7. The consensus voting method for multi-source time synchronization data according to claim 4, characterized in that, When the global support of multiple clock sources is the same at the maximum value, the clock source with the smallest channel number is selected as the seed clock source.

8. The consensus voting method for multi-source time synchronization data according to claim 1, characterized in that, The system time correction is calculated and output based on a subset of trusted clock sources, using a weighted average of the projected time deviations of each clock source within the subset of trusted clock sources. The weights are configured as either equal weights or based on the historical measurement quality of each clock source.

9. The consensus voting method for multi-source time synchronization data according to claim 1, characterized in that, The degradation strategy includes: Reuse the system time correction amount output from the previous valid voting cycle, or output the correction amount calculated based on a preset backup clock source.

10. A computer device, characterized in that, include: Memory, used to store computer programs / instructions; A processor for executing the computer program / instructions to implement the steps of the consensus voting method for multi-source time synchronization data as described in any one of claims 1 to 9.

Images