Apparatus and method for computer-aided monitoring of two time bases of two communication devices

Abstract

The subject of the present invention is a method (furthermore also a device and a computer program) for computer-aided monitoring of a first time reference of a first communication apparatus and a second time reference of a second communication apparatus. In a first procedure, in a measurement step (n) a Christian algorithm is applied to calculate a time offset interval of a time offset between the time references. In a second procedure, for a specific measurement step (n) and with the advancement of the measurement step (n+x) for the advanced later measurement step (n+x), the lowest upper limit is repeatedly set from the associated time offset interval (COW) as an upper limit of a result time offset interval (RCOW) and the highest lower limit is set as a lower limit of the result time offset interval (RCOW). In a third procedure, a monitoring is carried out to check whether the span of the result time interval (RCOW) tends to zero and / or to check whether the span of the result time interval (RCOW) tends to a non-zero limit value.

Description

Technical Field

[0001] This invention relates to a method for computer-aided monitoring of a first time reference of a first communication device and a second time reference of a second communication device. Furthermore, this invention relates to a computing environment or computing device comprising: a first communication device having a first time reference, a second communication device having a second time reference, and an interface for establishing a communication connection between the first and second communication devices. Finally, this invention relates to a computer program product and an apparatus for providing the computer program product, wherein the computer program product is equipped with program instructions for performing the method. Background Technology

[0002] A basic method for synchronizing time bases is known, for example, from the literature "Probabilistic clock synchronization" (Flaviu, Christian, Distributed Computing (1989) 3:146-158). The method described therein should be referred to hereinafter as the Christian algorithm, and can be essentially described by the method steps given at the beginning in the first flow of the method, wherein, in each measurement step, respectively...

[0003] • At a first time point related to the first time reference, the first communication device sends a first message to the second communication device.

[0004] • At a second time point related to the second time reference, the first message is received by the second communication device.

[0005] • At a third time point related to the second time reference, the second communication device sends a second message to the first communication device, and

[0006] • At a fourth time point related to the first time reference, the second message is received by the first communication device.

[0007] • The time offset interval is determined by the first time point, the second time point, the third time point, and the fourth time point. The time offset between the first time reference and the second time reference can be located within this time offset interval.

[0008] A method for evaluating time offsets between two time bases using the Christian algorithm is described in WO2019 / 223951 A1 and WO 2022 / 263152 A1. The Christian algorithm determines multiple time offset intervals, where an auxiliary window for possible time offsets can be formed by extrapolating temporally successive time offset intervals while taking into account the assumed drift of the time offset.

[0009] Security justifications for distributed computing environments typically rely on strategies to enhance fault tolerance through redundancy. This also requires reliable synchronization of communicating computing instances within the environment. If secure time progression is derived from two or more time bases, these time bases must be physically independent. This means security justifications depend on the time bases not being run on the same physical device (typically an oscillator). Computing environments using platforms with virtual computing instances (VMs), particularly those using COTS hardware (COTS stands for Commercial-off-the-Shelf), currently rely on deployment and maintenance rules that are quite cumbersome for their operators. This is because operators will be using an increasing number of VMs to execute their applications in the near future. Since VMs can be easily migrated to other physical machines, time bases initially running on independent physical devices may at some point inadvertently be running on the same physical device if VMs are (unintentionally and possibly automatically) migrated to the same physical machine.

[0010] One obvious solution is to monitor the hardware ID (e.g., MAC address) of the physical machine running the virtual machine. However, virtual machines can emulate MAC addresses to maintain network integrity and ensure effective communication between the virtual and physical networks. Therefore, it necessitates communication with additional software running locally on the operating system (outside the virtual machine) that has access to the physical machine's hardware ID, which incurs significant overhead. Summary of the Invention

[0011] The objective of this invention is to provide a method for computer-aided monitoring of a first time reference of a first communication device and a second time reference of a second communication device, which enables reliable and low-cost identification of whether the two time references are physically operating on the same hardware. Furthermore, the objective of this invention is to provide a computing environment, a computer program product, and a device for providing the computer program product, which enables the execution of the aforementioned method.

[0012] This task is solved according to the invention in the method given at the beginning by: in the second process, for a specific measurement step (n) and as measurement steps (n+x) progress, for later measurement steps (n+x), repeatedly from the associated time offset interval (COW).

[0013] • Set the minimum upper limit as the upper limit of the result time offset interval (RCOW), and

[0014] • Set the highest lower limit as the lower limit of the result time offset interval (RCOW).

[0015] In the third process, monitoring is performed to check whether the span of the Result Time Interval (RCOW) approaches zero and / or to check whether the span of the Result Time Interval (RCOW) approaches a non-zero limit value.

[0016] The first and second processes of the method of the present invention should be understood as sequences of method steps performed by computer aids to achieve the determined or calculated results described in more detail below. The result of the first process is required in the second process. However, this does not mean that these processes must be performed sequentially. These processes can also be performed in parallel, provided that each process is repeated, wherein the result of the previously completed first process is used for the currently executed second process, and the result of the previously completed second process is used for the currently executed third process.

[0017] The first step is to execute the Christian algorithm described at the beginning. After determining the four time points mentioned above, the time offset interval ∆(n) is determined according to the Christian algorithm. This time offset interval indicates the range of possible time offsets. The time offset, that is, the absolute time difference that may exist between the first time reference and the second time reference based on the measured time point, can only fall within this interval.

[0018] In the Christian algorithm, this is done so that the time offset ∆(n) is calculated based on the first, second, third, and fourth time points. The maximum possible error of the time offset e(n) can be calculated based on the first, second, third, and fourth time points, and considering the maximum possible error, the upper and lower limits of the time offset interval can be calculated (more on this below).

[0019] The first process involves repeated measurement steps. This can be interpreted as the first process forming the basis for executing the second process. In this second process, at least two measurement steps must be considered multiple times, namely an earlier measurement step n and a later measurement step n+x. Here, n is the number of the measurement step and is a natural number. A later measurement step has a distance x relative to an earlier measurement step, in terms of measurement steps, where this distance is also a natural number. For an adjacent later measurement step, x = 1 accordingly.

[0020] If the time offset intervals of the earlier and later measurement steps are known, then the resulting time offset interval of the considered measurement can be used so that, figuratively speaking, the result time offset interval is determined as the intersection of the considered time offset intervals in the third process.

[0021] The invention described below provides a solution that can identify whether they are operated by the same physical device based solely on the time offset of the time base and the progress judged according to the development of the resulting time offset interval.

[0022] For the solution according to the invention, the following considerations are crucial. The physical devices used to operate the time reference deviate from their nominal frequency primarily due to the manufacturing process, but also due to aging and temperature. Therefore, it can be assumed that time references operated by different physical devices will not advance at the same speed. If the values ​​of the time references are not periodically modified to compensate for this effect, for example by synchronizing with a common time source, the initial time offset between the two time references will inevitably change over time.

[0023] The offset of a time base (referred to as time offset) typically varies linearly with time. For an oscillator typically used in COTS hardware as a counter, the rate of change of the counter offset (hereinafter also referred to as drift) can reach 200 ppm (i.e., 200 microseconds per second) if the other counter is driven by a perfect clock. If both counters are driven by an oscillator typically used in COTS hardware, the rate of change of the time offset can realistically reach up to 400 ppm in a fault-free state. If we assume that the two time bases have only a 10 ppm drift on their time offsets, their counter offset increases by 36 milliseconds after one hour. However, if both timers are driven by the same oscillator, the actual rate of change of the counter offset is always zero. According to the invention, the strategy now lies in periodically measuring the counter offset (i.e., the time offset window formed by the upper and lower limits, called COW).

[0024] If the time base is not run by the same oscillator, then the "cut window" representing the resulting time offset interval (see [link]). Figure 6 The depth of these timers will decrease over time (i.e., they converge to zero). Conversely, if the timers are driven by the same oscillator, the "cut-out window" (see...) will decrease over time. Figure 7 The time will quickly converge to a minimum possible cycle time at its depth. From this point onward, intersections based on new measurements will no longer result in a smaller “window”. If the window no longer shrinks after a characteristic (configurable) number of measurements, it is considered a loss of the identified independent time source for the time reference.

[0025] To execute the method according to the invention, in principle, it is sufficient for the span of the monitoring result time offset interval to approach zero or approach a limit value. If, in these alternatives, one limit value is reached or alternatively another limit value is reached after a period of time that can be defined as a time interval or a number of measurements, a definite result exists. If zero is not reached or alternatively the limit value is not reached, a corresponding opposite result can be inferred. However, it is particularly advantageous to simultaneously monitor the span of the monitoring result time offset interval to approach zero and approach a limit value. In this case, the method is advantageously particularly robust because, for example, one or the other result should be reached within a predetermined time interval. If neither result is reached, the existence of another (unknown) error can be inferred.

[0026] This method also advantageously allows the use of COTS (Commercial Off-the-Shelf) components as a time base for operating safety-related communication devices, whose synchronized communication is a prerequisite for the method. As an example of application, communication technologies in railway operations, which must meet high safety standards, can be cited.

[0027] When a device has a computing environment, the device is computer-aided or computer-implemented; or when a computing environment performs at least one method step of the method, the method is computer-aided or computer-implemented.

[0028] A computing environment is a type of IT infrastructure that consists of functional components such as processors, storage units, programs, and data to be processed by the programs to execute at least one application that performs a task. Other functional components may consist of sensors and actuators, which enable the computing environment to interact with the outside world. IT infrastructure can also be organized as a network of these functional components.

[0029] The cloud (also known as the computing cloud or data cloud) is a computing environment used for what is called cloud computing. It refers to an IT infrastructure provided via a network interface such as the internet. It typically includes storage space, computing power, or software as a service, which does not necessarily need to be installed on computing instances utilizing the cloud. The services provided within cloud computing encompass the entire range of information technology, particularly including IT infrastructure, platforms, software, and computing power, where cloud providers allocate resources to cloud users based on demand, with the goal of optimizing resource utilization.

[0030] Because computer-implemented solutions in railway technology adhere to high security standards in terms of functionality (operational safety) and vulnerability (transmission security), the functionality of the cloud used in railway technology is typically limited in terms of its shared availability. This is especially true given the potentially unlimited number of cloud users requiring access. However, access must also be limited in terms of redundancy required for allocating computing resources across different computing instances. In light of these limitations for railway technology, this technology is also referred to as a private cloud in the context of this invention, even though a private cloud only partially meets the technical characteristics associated with cloud technology.

[0031] Computational instances form functional units within a computing environment. These functional units can be assigned to applications (e.g., provided by multiple program modules) and can execute these applications. When executing applications, these functional units form a physically (e.g., computer, processor) and / or virtually (e.g., program modules) self-contained system.

[0032] A computer is an electronic device with data processing capabilities, composed of multiple functional components. Computers can be, for example, clients, servers, handheld computers, communication devices, and other electronic devices used for data processing. They may have processors and storage units, and can also be connected to a network via interfaces.

[0033] A processor can be, for example, a converter, a sensor for generating measurement signals, or an electronic circuit. A processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or a digital signal processor, and may be combined with memory units for storing program instructions and data. A processor can also be understood as a virtualized processor or a soft CPU.

[0034] Storage units can be implemented on computer-readable storage devices in the form of system memory (RAM) or data storage (hard disk or data carrier).

[0035] A program module is a separate software functional unit that implements the program flow of the method steps according to the invention. These software functional units may be implemented in a single computer program or in multiple communicating computer programs. The interfaces implemented herein may be implemented in software technology within a single processor, or in hardware technology when multiple processors are used.

[0036] The interface can be implemented in hardware technology, such as a wired connection or a wireless connection, or it can be implemented in software technology, such as an interaction between individual program modules of a single computer program or multiple computer programs, and used for data exchange, preferably in the form of digital datasets or analog signals.

[0037] According to an extended embodiment of the invention, in the second process, not only for a specific measurement step (n) and as measurement step (n+x) progresses to a later measurement step (n+x), but also for all measurement steps (n+1 … n+x-1) located between the specific measurement step (n) and the later measurement step (n+x), the process is repeatedly performed from the associated time offset interval (COW).

[0038] • Set the minimum upper limit as the upper limit of the result time offset interval (RCOW), and

[0039] • Set the highest lower limit as the lower limit of the result time offset interval (RCOW).

[0040] By considering all measurement steps between a specific measurement step and the final advancing measurement step, the method is advantageously made more robust to measurement inaccuracies. Furthermore, this allows for better tracking of the development of the result time interval span. In particular, when both time bases use the same physical timer, it is possible to determine more quickly whether the span of the result time offset interval approaches zero or a limit value, thus enabling a faster response.

[0041] According to an extended embodiment of the present invention, checking whether the span of the result time interval (RCOW) approaches a non-zero limit value involves checking whether the span of the result time offset interval continues to decrease when the upper and lower limits of the result time interval are repeatedly set.

[0042] In this case, the non-zero limit value to be reached (hereinafter referred to as the limit value, where the limit value is not zero) need not be known, because the fact that a certain limit value is reached can be reliably regarded as proof that the two time bases being examined are implemented by the same physical timer.

[0043] The nature of this limit value determines that a check can be performed to determine whether the span of the result time interval remains unchanged over a long period. It is recognized that, for functional reasons, either such a limit value exists and is determined (and furthermore, this limit value must be clearly distinguishable from zero), or it is determined to be zero, and these values ​​can therefore be used in measurement techniques as a clear distinguishing criterion (i.e., zero relative to the limit value) within the achievable measurement accuracy range. This has always been crucial for configuring the method in accordance with the invention.

[0044] In technical implementation, it goes without saying that measurement inaccuracies must be considered. In other words, from a technical point of view, the standard that the span does not change over a long period of time and is therefore at its limit or zero means that the measured value does not deviate from the tolerance range (considering expected measurement errors) that includes that limit or zero over a long period of time.

[0045] According to an extended scheme of the present invention, an error signal is generated when the span of the result time interval (RCOW) approaches the limit value.

[0046] The situation described here is considered evidence that both time bases are accessing the same timer, and therefore must be displayed. This error signal can be used for various purposes. It can be automatically evaluated and trigger a response in the monitored device or computing environment. However, it can also be output so that it can be evaluated in a computer-aided manner or by personnel outside the device or computing environment. If one timer fails, it is impossible to switch to a (non-existent) second timer, and the running technical process must be stopped. To restore redundancy, appropriate technical measures (e.g., restarting or replacing the failed timer) can be derived from the error signal. If the timers form a 2oo3 system, where the three timers are compared in pairs according to the method of the invention, the method can even continue to operate as long as the result time interval of at least one of the three pairs of timers studied approaches zero. This can be considered evidence that at least one pair of timers functioning correctly as the time base exists.

[0047] According to an extended embodiment of the invention, the number of consecutive executions (h) used for inspection in the third process is determined, within which a pause in the span of the result time offset interval (RCOW) is accepted, and then an error signal is generated.

[0048] The number of times h can be derived from the fault detection time (FDT) required by the device or computing environment and therefore cannot be exceeded, as well as the cycle time C for repeated measurements:

[0049] h = FDT / C

[0050] To increase the robustness of the method to error assessment, the cycle time C can be reduced so that more measurements h can be performed during FDT.

[0051] In technical implementation, it goes without saying that measurement inaccuracies must also be considered. In other words, from a technical point of view, the standard that the span does not change over a long period of time and is therefore at its limit means that the measured value does not deviate from a tolerance range (considering expected measurement errors) that includes that limit value over a long period of time.

[0052] According to an extended embodiment of the present invention, the time offset in measurement step n is calculated based on the transmission time of the first message, which is the time difference between the first time point and the second time point, and the transmission time of the second message, which is the time difference between the third time point and the fourth time point.

[0053] Specifically, the difference between these two time differences can be used to assess the potential time offset between the two time bases. The underlying consideration is that a time offset causes the measured time to shift relative to the actual time. Thus, the measured transmission time of one message becomes shorter, and the measured transmission time of another message becomes longer, where these messages are the first and second messages in the first flow of the method. In this respect, the time offset has a dual effect on the measured transmission time.

[0054] For example, it can be specified that the time offset Δ(t) in measurement step n is calculated according to the following formula:

[0055]

[0056] The fact that the result (in the denominator) is divided by two takes into account the fact that, as mentioned earlier, the time offset has a dual effect on the measured transmission time. However, if this is taken into account in subsequent steps of the method, it is not necessary to divide the result by two (more on this below).

[0057] According to an extended embodiment of the present invention, the maximum possible error of time offset in measurement step n is calculated by taking into account the message transmission time, which is the time difference between the first time point and the fourth time point measured in the first communication device, and the reaction time, which is the time difference between the second time point and the third time point measured in the second communication device.

[0058] The measured message transmission time is not the actual message transmission time. This can be explained by the fact that the measurement contains measurement errors. The largest measurement error lies in the fact that the time difference between the first and fourth time points does not take into account the reaction time in the second communication device from receiving the first message to sending the second message.

[0059] However, the measurement error mentioned last is easy to determine. It lies in the measured reaction time, which can be calculated as the time difference between the second and third time points, i.e., the measured message transmission time minus the measured reaction time. Therefore, subtracting the measured reaction time from the measured message transmission time will yield a result closer to the actual message transmission time.

[0060] Furthermore, if we consider that the signal propagation time may fluctuate due to irregularities in the transmission path, this result constitutes a measure of the maximum possible error. These fluctuations are significant compared to the measurement accuracy required to determine the relevant measured time point. Therefore, the measurement error based on fluctuations during transmission, determined with consideration of the reaction time of the second communication device, can be estimated with sufficient precision.

[0061] For example, it can be specified that the maximum possible error e(n) of the relevant measurement step n is calculated according to the following formula:

[0062]

[0063] The time difference between the fourth time point and the first time point gives the measured signal propagation time. The reaction time of the second communication device, determined by the time difference between the third and second time points, can be subtracted from this. Since two transmissions are involved, the result (denominator) can be divided by two to obtain the maximum possible error for each transmission.

[0064] Alternatively, the division by two can be omitted if it is taken into account in subsequent calculations. Therefore, the maximum possible error can also be calculated using only the denominator described above.

[0065] In other words, it can be determined that the actual time offset δ(n) of measurement step n is reliably located within the following interval.

[0066]

[0067] in

[0068] 𝛥u(n) is the lower limit of the time offset interval for this measurement step.

[0069] 𝛥o(n) is the upper limit of the time offset interval for this measurement step.

[0070] Substituting equations (1) and (2) into equation (3), we obtain the upper and lower limits of the time offset interval of the actual time offset δ(n):

[0071]

[0072] According to an extended embodiment of the present invention, the lower limit φu(n) of the time offset interval for measurement step n is calculated according to the following formula:

[0073]

[0074] Furthermore, the upper limit of the time offset interval of measurement step (n), 𝛥o(n), is calculated according to the following formula:

[0075] .

[0076] As explained above, in these formulas (4), both the measurement of the time offset Δ(t) and the estimation of the error t(t) are taken into account.

[0077] According to an extended embodiment of the present invention, the time difference between an earlier measurement step and a later measurement step n+x is calculated, wherein, in order to determine the time difference, a first time point, a second time point, a third time point, or a fourth time point of measurement of the earlier and later measurement steps are considered.

[0078] This time difference provides a measure of the time interval between the earlier and later measurement steps. This time difference is necessary for determining the drift based on the determined time offset, since drift is defined as the change of time offset over time. Advantageously, it is preferable to use time points that are available in any way when determining the measurement results of the measurement steps. Here, comparable time points are used respectively, i.e., for example, the fourth time point of the earlier measurement step and the fourth time point of the later measurement step (similarly applicable to the first, second, and third time points).

[0079] According to an extended embodiment of the invention, a time interval is defined for the second process, and all earlier and later measurement steps to be considered must fall within this time interval.

[0080] The evaluation can be performed separately after the process within the time interval, or it can be performed repeatedly during the process within the time interval using existing measurements, by executing a second process. When determining the length of the time interval, the following conditions can be considered for the execution of the second process.

[0081] The time interval must be long enough that, technically speaking, a time offset drift can be determined with high probability by the result time offset interval approaching zero, or a drift can be determined with high probability by approaching the minimum possible cycle time. If the evaluation is performed during the time interval, the early fulfillment of one of the above two conditions can be used as a criterion for early termination of the evaluation. Therefore, instead of waiting for the end of the time interval, a new time interval with a new evaluation begins.

[0082] The task is also addressed according to the invention by means of the subject matter of the claims given at the beginning (computing environment), namely, the computing environment is configured to perform the method for computer-aided monitoring as described in any of the preceding claims.

[0083] As a computing environment in the context of this invention, it should be understood as a technical device in which different communication devices of the device need to exchange data. This is particularly true in situations where the device has multiple computers, and these computers must operate in a manner that requires synchronous data exchange via a first communication device and a second communication device.

[0084] According to one extension of the present invention, the interface for establishing a communication connection is provided via the cloud.

[0085] In this scenario, the device can consist of individual technical components, with its communication connectivity guaranteed as a service, for example, by a cloud provider. When communicating via the cloud, transmission times can fluctuate, and therefore the method of the present invention can be used particularly advantageously to monitor these fluctuations by forming a result time offset window in the manner of the invention.

[0086] "Cloud" should be understood as the environment used for "cloud computing" (German: computer cloud or data cloud). It refers to IT infrastructure provided through network interfaces such as the internet. It typically includes storage space, computing power, or software as a service, without necessarily installing them on a local computer utilizing the cloud. Services provided within the scope of cloud computing cover the entire range of information technology, especially infrastructure, platforms, and software.

[0087] According to one extended embodiment of the invention, the device is a railway technical device.

[0088] As previously mentioned, railway technology equipment such as signal towers particularly benefit from the application of the method of the present invention, because reliable monitoring can be performed with regard to the undesirable use of the same hardware component for two time bases.

[0089] The advantages described above in relation to the method can be achieved using this device. The same applies to the device described in this invention as to the method of this invention.

[0090] Furthermore, a computer program product having program instructions is claimed for performing the method of the present invention and / or embodiments thereof, wherein the method of the present invention and / or embodiments thereof can be performed by means of the computer program product.

[0091] Furthermore, protection is claimed for a providing device for storing and / or providing the computer program product. This providing device is, for example, a storage unit for storing and / or providing the computer program product. Alternatively and / or additionally, the providing device is, for example, a network service, a computer system, a server system, particularly a distributed, such as cloud-based, computer system and / or virtual computer system, which preferably stores and / or provides the computer program product in the form of a data stream.

[0092] The provision is made in the form of program data blocks as files of the computer program product, particularly download files, or as a data stream of the computer program product, particularly a download data stream. The provision can also be made, for example, as a partial download consisting of multiple parts. Such a computer program product is read into a system, for example, using the provision device, so that the method of the present invention can be executed on a computer.

[0093] Further details of the invention are described below with reference to the accompanying drawings. Identical or corresponding elements are always given the same reference numerals, and multiple descriptions are only used where differences exist between the figures.

[0094] The embodiments described below are preferred embodiments of the present invention. In the embodiments, each component of the described embodiments represents a feature of the present invention that can be viewed independently of each other. These features also independently improve the present invention and should therefore be considered individually or in combinations different from those shown as part of the present invention. Furthermore, the described components can also be combined with the features of the present invention described above. Attached Figure Description

[0095] Figure 1 An embodiment of the device of the present invention and its functional relationships are illustrated schematically.

[0096] Figure 2 Showing according to Figure 1 An embodiment of the computer infrastructure for the communication devices in the equipment includes a computer as a block diagram composed of functional units, wherein processing modules, which may run on one or more processors, and wherein the interfaces may be implemented accordingly using software or hardware technology.

[0097] Figure 3 An embodiment of the method of the present invention is shown as a flowchart, wherein each method step can be implemented individually or in groups by program modules, and wherein according to Figure 2 The functional units and interfaces are illustrated by way of example.

[0098] Figure 4 The illustration shows, in the first process, the Christian algorithm is executed using two time bases offset by a time offset δ.

[0099] Figure 5 In the second process, the determination of the time offset interval is shown in the graph of time offset ∆ as a function of time t.

[0100] Figure 6 and Figure 7 This illustrates how, in the third process, the result time offset interval is determined from each time offset interval on each pair of measurements n, n+x, where... Figure 6 The diagram illustrates a scenario where two time bases are used with two different timers. Figure 7 The diagram shows a case where two time bases use the same timer. Detailed Implementation

[0101] Figure 1 A device in a railway environment is schematically illustrated, in which an embodiment of the method of the present invention can operate. The illustration shows a track GL in which a trackside device SE is installed. This trackside device provides a second communication device K2, which is connected to the cloud CLD via a second interface S2. Another component is provided by a signal tower SW. This signal tower has a first communication device K1, which is also connected to the cloud CLD via a first interface S1.

[0102] Therefore, via the cloud CLD, the first communication device K1 and the second communication device K2 can communicate with each other using the first interface S1 and the second interface S2. Alternatively, direct communication between the first communication device K1 and the second communication device K2 may be ensured via a wired connection or a radio interface (not shown). The railway components communicating with each other can also be ensured by railway components different from the signal tower SW and trackside equipment SE shown.

[0103] Signal towers (SW) and trackside equipment (SE) serve as the computing environment (RU), and their functional components are... Figure 2 The diagram is schematically shown as a block diagram. The signal tower SW has a first computer CP1, which is connected to a first storage device SE1 via a third interface S3. Furthermore, a first timer ZG1, forming a first time reference ZB1, is provided. This first timer is connected to the computer CP1 via a fourth interface S4 and to a first communication device K1 via a fifth interface S5. The results of an application program running on the signal tower and calculated by the first computer CP1 can also be transmitted to the first communication device K1 via a sixth interface S6.

[0104] The first communication device K1 is used to communicate with the second communication device K2 in the trackside equipment SE. This has been combined. Figure 1 The following description is provided. The second communication device K2 is connected to the second time reference ZB2 via the seventh interface S7. Synchronous communication between the first communication device K1 and the second communication device K2 is ensured through the first time reference ZB1 and the second time reference ZB2.

[0105] In addition, the hardware infrastructure of the trackside equipment (SE) is similar in structure to that of the signal tower (SW), at least in terms of... Figure 2This is the abstract level shown. That is, the timer ZG2, which forms the second time reference ZB2, is connected to the second computer CP2 via the eighth interface S8. The second computer itself is connected to the second communication device K2 via the ninth interface S9. The second computer CP2 is also connected to the second storage device SE2 via the tenth interface S10.

[0106] With the help of Figure 3 The flow of the method of this invention can be understood from the flowchart. After the method starts, the running variable n=1 because the first measurement step n is executed. Therefore, n represents the measurement step, which is 1 during the first run.

[0107] Depending on the requirements of the method being run, other method steps can then be selected, where... Figure 3 The method for determining these requirements is not shown in detail. Therefore, the three possible steps are simply shown in parallel. Afterwards, sending steps SND K1–K2 can be performed, where the message is sent from the first communication device K1 to the second communication device K2. Alternatively, if the message is to be sent from the second communication device K2 to the first communication device K1, sending steps SND K2–K1 can be performed. Which direction of transmission is required depends on the operation of the corresponding application. Message transmission related to application processing is preferred over the third alternative described below.

[0108] Subsequently, to ensure the first process AL1 of the method of the present invention, the sending steps SND K1–K2 are first executed to send the message from the first communication device K1 to the second communication device K2. The second communication device responds by sending the message back from the second communication device K2 to the first communication device K1 in the sending steps SND K2–K1. As will be further explained below, these two sending steps can be used to calculate a time offset interval COW for these two sending steps in the calculation step CLC COW, and the possible actual time offset ∆(n) can lie within this time offset interval. Subsequently, in step n=n+1, the running variable n is incremented by 1.

[0109] Regardless of which of these three alternatives is executed, in the subsequent query step t>ZI, it is checked whether the elapsed time t is still less than the defined time interval ZI (e.g., set to one minute). If so, one of the three alternative methods is repeated. However, if the time interval ZI has elapsed, the first process AL1 is completed, in which the alternative method for determining the time offset interval COW is repeated.

[0110] After the first process AL1 is completed, the next query step STP queries whether the method used to execute the application should be stopped overall. If so, the method ends with STOP. If not, the run variable is reset to 1 again in step n=1, allowing the first process AL1 to restart.

[0111] Once the first process AL1 is completed, the second process AL2 can begin. Here, in the setup step ST, measurement step 1 or a later measurement step n (preferably the current measurement step) is selected. By comparing the time offset interval COW (explained in more detail below), the upper limit of the resulting time offset interval RCOW(n) ​​can be determined in the calculation step CLC RCOWo, and its lower limit can be determined in the calculation step CLC RCOWu. Taking these two limits into account, the resulting time offset interval RCOW(n) ​​can be calculated in the calculation step CLC RCOW, which is of great significance for further consideration in the third process AL3 (explained in more detail below).

[0112] In the query step RCOW=GW?, in the third process AL3, it is checked whether the limit value GW of the span development of RCOW in the result time interval has been reached (see...). Figure 7 If so, generate an error signal FS in the generation step GN FS. Otherwise, continue to the next query (see below). The determined limit value GW (see...) Figure 7 This can lead to different measures in further process flows, in Figure 3 Two of these measures are alternatively illustrated. For example, an output step OT FS can be performed to output an error signal FS, which is displayed on an output device not shown in detail. The error signal can also be handled automatically, for example, to stop the ongoing process (STOP) of a user program targeting a (railway-specific) application running on a computer CP.

[0113] Alternatively, in response to an error signal, the unused time base ZB can be restarted in the correction step CRC ZG, thereby reintegrating the first time base ZB1 and the second time base ZB2 into the process. Here, the other time base can be used as a reference and adapted to the time base used as the reference.

[0114] In the query step RCOW=0, has the time interval of the query result become zero? (See...) Figure 6If this is the case, the method restarts to continue monitoring the time base and timer. Additionally, in another query step, NXT CMB, it is queried whether another combination of measurement steps should be checked. In this case, in the change step CNG n,x, the earlier measurement step n and another distance x between the earlier measurement step n and the later measurement step n+x are determined. The method described in the second and third processes above can be executed again. Otherwise, the method restarts to continue monitoring the time base and timer.

[0115] Figure 4 The diagram schematically illustrates how to measure the first time point T1, the second time point T2, the third time point T3, and the fourth time point T4 using the Christian algorithm. These time points T1...T4 are plotted on the first time axis t1 for the first time reference ZB1 and the second time axis t2 for the second time reference ZB2, respectively. This clearly shows that the time points are determined using different time references, and there may be a real time offset δ between these time references, which is plotted between the first time axis t1 and the second time axis t2. However, this time offset is unknown and is estimated in the manner already described by applying the Christian algorithm while considering the four time points.

[0116] The results of such estimations for n = 1 ... 3 are exemplarily shown in Figure 5 The diagram shows the distance of each measurement n in... Figure 5 The values ​​are plotted on the time axis t (x-axis) (in reality, more measurements are needed to perform this method, of course). The calculated time offset ∆ is plotted on the y-axis. Measurements n = 1 ... 3 all lie within the specified time interval ZI. The time offset intervals COW1 ... COW3 belonging to each measurement n are based on... Figure 4 Calculated according to the Christian algorithm. These are the intervals within which the actual time offset Δ must lie. For example, for the first measurement (n = 1), they have a lower limit Δu(1) and an upper limit Δo(1), respectively. Furthermore, the average value Δ(1) can be determined; however, this average value is not important for the further calculations presented here. This similarly applies to the second time offset window COW2 and the third time offset window COW3. More time offset windows COW4... can be determined within the time interval ZI (not shown, but see...). Figure 6 and Figure 7 ).

[0117] By comparison Figure 6 and Figure 7 The illustrations in the diagrams can explain the differences arising from whether the two time bases considered in this invention are implemented using one timer or two timers. Figure 6 This indicates the normal state, meaning that two timers are used as originally set for the method flow. In contrast, Figure 7 The process in the diagram is generated when two time bases are run on a single timer. This diagram corresponds to... Figure 5 The illustration in the image. Figure 6 and Figure 7 The example shows five time offset intervals, where the fourth time point T4(n) is used to indicate the recording time point.

[0118] Time offset intervals COW1 … COW5 Figure 6 and Figure 7 The results are marked accordingly. Similarly, the result time offset intervals RCOW1 … RCOW4 are marked accordingly. Whenever the time offset intervals and result time offset intervals are shown in pairs, the relevant time offset interval is on the left and the relevant result time offset interval is on the right. The relevant result time offset intervals are respectively indicated by… Figure 6 and Figure 7 The overlapping region between the first time offset interval COW1 and the corresponding time offset interval COW(n+x) is shown as a pair, and this overlapping region is shown together with the corresponding result time offset interval COW(n+x-1).

[0119] also, Figure 6 The shaded line in the middle indicates the case where the EEG narrows to zero within the time interval ZI. Figure 7 The diagram illustrates the narrowing to the limit value GW, where the time interval must be less than or equal to the required fault detection time of the device. For the determination of the first result time offset interval RCOW1, the narrowing corresponds precisely to the overlapping area of ​​the two considered time offset intervals COW1 and COW2. Through subsequent steps in determining the result time offset interval RCOW(1+x), these intervals can only further restrict the monitoring assessment, not expand it.

[0120] for Figure 6 When the time bases are placed in different timers, due to the inevitable result drift (DRF) between the time bases, the narrowing of the EEG using the narrowing speed VEG causes the result time offset interval to become zero within the time interval ZI. This proves that the two time bases are placed in different timers.

[0121] for Figure 7 When both time bases are placed in the same timer, drift is impossible, as represented by the straight line GRD. Therefore, the narrowed EEG stabilizes at the limit value GW, which will not be further narrowed by fluctuations in the determination process of the resulting time offset interval RCOW(n+X). This proves that both time bases are placed in the same timer.

[0122] List of reference numerals

[0123] GL orbit

[0124] SW signal tower

[0125] SE trackside equipment

[0126] CLD Cloud

[0127] RU computing environment

[0128] ZI Time Range

[0129] ZG1, ZG2 timers

[0130] ZB1, ZB2 time base

[0131] SE1, SE2 storage devices

[0132] CP1, CP2 computers

[0133] S1 … S10 interface

[0134] K1, K2 communication device

[0135] T1 ... T4 time points

[0136] N1, N2 messages

[0137] n Measurement steps

[0138] x Distance between measurement steps

[0139] t time

[0140] Δ Time offset

[0141] COW1…5 Time Offset Interval

[0142] DRF drift

[0143] VEG narrowing speed

[0144] EEG narrowing

[0145] RCOW1…4 Result Time Offset Interval

[0146] GRD Straight Line

[0147] GW limit

[0148] Δo is the upper limit of the time offset interval.

[0149] Δu is the lower limit of the time offset interval.

[0150] Δ Actual time offset

Claims

1. A method for computer-aided monitoring of a first time reference (ZB1) of a first communication device and a second time reference (ZB2) of a second communication device, in, In the first process, the measurement steps (n; n+1; n+2 …) are repeated, wherein in each measurement step, respectively… • At a first time point (T1) related to the first time reference (ZB1), the first communication device (K1) sends a first message (N1) to the second communication device (K2). • At a second time point (T2) related to the second time reference (ZB2), the first message (N1) is received by the second communication device (K2). • At a third time point (T3) related to the second time reference (ZB2), the second communication device (K2) sends a second message (N2) to the first communication device (K1), and • At the fourth time point (T4) related to the first time reference (ZB1), the second message (N2) is received by the first communication device (K1). • A time offset interval (COW) is determined by a first time point, a second time point, a third time point, and a fourth time point. The time offset between the first time reference and the second time reference must fall within this time offset interval. Its features are, In the second process, for a specific measurement step (n) and as measurement steps (n+x) progress, for later measurement steps (n+x), the process is repeatedly performed from the associated time offset interval (COW). • Set the minimum upper limit as the upper limit of the result time offset interval (RCOW), and • Set the highest lower limit as the lower limit of the result time offset interval (RCOW). In the third process, monitoring is performed to check whether the span of the result time interval (RCOW) approaches zero and / or to check whether the span of the result time interval (RCOW) approaches a non-zero limit value (GW).

2. The method according to claim 1, Its features are, In the second process, not only for a specific measurement step (n) and for later measurement steps (n+x) as measurement steps (n+x) progress, but also for all measurement steps (n+1 … n+x-1) located between a specific measurement step (n) and a later measurement step (n+x), the process is repeatedly performed from the associated time offset interval (COW). • Set the minimum upper limit as the upper limit of the result time offset interval (RCOW), and • Set the highest lower limit as the lower limit of the result time offset interval (RCOW).

3. The method according to claim 1 or 2, Its features are, The check whether the span of the result time interval (RCOW) approaches a non-zero limit value (GW) is whether the span of the result time offset interval (RCOW) continues to decrease when the upper and lower limits of the result time interval (RCOW) are repeatedly set.

4. The method according to any one of the preceding claims, characterized in that, An error signal is generated when the span of the result time interval (RCOW) approaches the limit value (GW).

5. The method according to claim 4, Its features are, The number of times (h) the checks are performed consecutively in the third process is determined. Within this number of times, a pause is accepted across the span of the result time offset interval (RCOW), and then an error signal is generated.

6. The method according to any one of the preceding claims, Its features are, The time offset in measurement step (n) is calculated based on the following factors: • The sending time of the first message (N1), which is the time difference between the first time point (T1) and the second time point (T2), and • The sending time of the second message (N2), which is the time difference between the third time point (T3) and the fourth time point (T4).

7. The method according to any one of the preceding claims, Its features are, The maximum possible error of the time offset (∆) in measurement step (n) is calculated considering the following factors: • The message transmission time, measured in the first communication device (K1) as the time difference between the first time point (T1) and the fourth time point (T4), and • The reaction time, measured in the second communication device (K2), is the time difference between the second time point (T2) and the third time point (T3).

8. The method according to any one of the preceding claims, Its features are, The lower limit of the time offset interval of measurement step (n), denoted as φu(n), is calculated according to the following formula: The upper limit of the time offset interval of measurement step (n), denoted as φo(n), is calculated according to the following formula: 。 9. The method according to any one of the preceding claims, Its features are, Calculate the time difference between an earlier measurement step (n) and a later measurement step (n+x), wherein, in order to determine the time difference, the first time point (T1) or the second time point (T2) or the third time point (T3) or the fourth time point (T4) of the earlier and later measurement steps are considered.

10. The method according to any one of the preceding claims, Its features are, For the second process, a time interval (ZI) is determined, and all earlier measurement steps (n) and later measurement steps (n+x) to be considered must be within the time interval.

11. Computing environment, including: A first communication device (K1) having a first time reference (ZB1), a second communication device (K2) having a second time reference (ZB2), and an interface (S1, S2) for establishing a communication connection between the first communication device and the second communication device. Its features are, The device is configured to perform the method for computer-aided monitoring as described in any of the preceding claims.

12. The device according to claim 11, Its features are, The interface used to establish communication connections is provided through the cloud (CLD).

13. The device according to claim 11 or 12, Its features are, This computing device is a railway technology device.

14. A computer program product having program instructions for performing the method according to any one of claims 1 to 10.

15. An apparatus for providing a computer program product according to claim 14, wherein, The device provides storage and / or provides the computer program product.

Images