METHOD AND SYSTEM FOR TIME SYNCHRONIZATION

Description

[0001] The invention relates to a method for time synchronization in a system, in particular the control of a motor vehicle, according to the preamble of claim 1.

[0002] Such a procedure is explained, for example, in DE 102011 087 472 A1 or US 2016 / 0315756 A1.

[0003] DE 10 2011 087 472 A1 describes how a synchronization telegram from a master node is evaluated in the slave node to synchronize the clock speed of the slave clock with the clock speed of the master clock. The slave node then sends a delay request telegram to the master clock, which is answered by a delay response telegram.

[0004] US 2016 / 0315756 A1 explains communication with a device under test, which responds with a back-synchronization message that reports the time of the synchronized clock of the device under test.

[0005] WO 2020 / 151896 concerns the temporal synchronization between two networks.

[0006] For example, the system is used to control and / or monitor a motor vehicle. The system comprises, for example, one or more control units and sensors. The sensors are necessary to perceive the vehicle's environment. They collect sensor data from the vehicle's physical surroundings at different times. This data must be correlated with each other in time. To achieve this, the environmental data must be annotated with time information, such as timestamps. A system component that processes the sensor data, such as a control unit for a vehicle stability program, a control unit for autonomous driving, or similar, correlates the sensor data in time using the associated time information.

[0007] It is essential that the system components communicating time-sensitive messages operate on the same time base. Accordingly, the timer specifies the time, which is then adopted by the timers. The timer is therefore, for example, a so-called time master, while the timer(s) are called time slaves. The timer and the at least one timer are networked, for example, via a bus line, such as a CAN bus, a FlexRay bus, or similar. The timer and the at least one timer form, for example, a so-called time domain.

[0008] When the system is used in a safety-critical area, such as for autonomous driving, high temporal accuracy of the sensor data is required to ensure correct temporal correlation during evaluation. Therefore, it is essential that the timer and time receiver are synchronized as optimally as possible.

[0009] The accuracy of the time of the timekeeper clock of the time slave or timekeeper can be improved, for example, by the timer sending one or more additional time synchronization messages to the timekeeper.

[0010] However, such a procedure is complex and, in the event of an error, especially in the case of a faulty transmission of a time synchronization message or the like, cannot ensure that the timer and timekeeper are sufficiently synchronized.

[0011] It is therefore the object of the present invention to provide an improved method for time synchronization.

[0012] To solve the problem, a method according to the technical teaching of claim 1 is provided.

[0013] Furthermore, a time synchronization system according to the technical teaching of claim 12 is provided to solve the problem.

[0014] The task is further solved by a timer and a timekeeper of the aforementioned system.

[0015] The timer and / or the timekeeper can be designed as software or as software components with program code executable by a processor. The timer and / or the timekeeper can comprise one or more software modules or be designed as one or more software modules. For example, the timer and / or the timekeeper is designed as a time module or comprises a time module. For example, it is provided that the timer and / or the timekeeper, for instance the time module, comprises program code that is executable by a processor, so that the timer or the timekeeper or the time module performs the steps of the method according to the invention as well as the advantageous embodiments of the method described below when the program code is executed by the processor.It is understood that different time modules may be provided to supply the functionality of the timer and the functionality of the timekeeper.

[0016] The timer and the timekeeper can be designed as devices or be components of devices, for example components of a control unit for a motor vehicle, a sensor for a motor vehicle or the like.

[0017] The timer and / or the timekeeper, for example, include a processor for executing program code of the time module, with the time module performing the respective process steps of the timer or the timekeeper, or both. As will become clear later, a device can perform the role of both a timer and a timekeeper in the system, or contain at least one timekeeper and at least one timer. Thus, for example, a device can be a timer for, or have a timer for, a device connected to it in the system, but be a timekeeper or have a timer with respect to another device.

[0018] A fundamental concept of the present invention is that, so to speak, a resynchronization of the timer by the timekeeper takes place.

[0019] The timekeeper time information in the time resynchronization message contains, for example, the time of the timekeeper's clock, such as the time of the timekeeper's clock at the time the time resynchronization message was sent.

[0020] Time synchronization itself can be carried out, for example, according to a standardized protocol, such as IEEE 1588 or AUTOSAR.

[0021] The timer or a device containing the timer in the system is, for example, a control unit of a motor vehicle.

[0022] The control unit, for example, controls the driving stability of the vehicle, is designed for autonomous driving of the vehicle, or similar functions.

[0023] The timer is preferably a device with a sensor or a sensor itself. The sensor is, for example, a camera, a radar sensor, an ultrasonic sensor, an accelerometer, or a sensor required for an electronic stability program and / or autonomous driving. It is essential that sensor signals or values ​​sent by such sensors to the timer or the system component containing the timer are synchronized with time information and / or based on synchronized time, so that the timer or the component containing the timer can relate them to a temporal context.For example, image information from a camera can be linked to a sensor value from an ultrasonic sensor in terms of timing in order to control a function of a motor vehicle, for example to influence its driving stability and / or to control it within the framework of autonomous driving.

[0024] Advantageously, the timekeeper or a device containing the timekeeper sends message notifications to the timer or a device containing the timer. Such a message notification contains notification information, for example, a sensor value, as well as time information, for example, a so-called timestamp, which qualifies the notification information. The time information is preferably generated or generable from the timekeeper clock. For example, the notification information can be a sensor value, with the time information specifying the acquisition time of the sensor value.

[0025] The time resynchronization message is preferably a separate message from any timekeeper's message or messages. A message is one that does not contain time information or contains time information in addition to other message information, such as a sensor value. The time resynchronization message preferably serves solely for resynchronization or feedback and / or contains only the time set on the timekeeper's clock. Therefore, it is advantageous if the time resynchronization message is a separate message from the timekeeper's messages, serving solely to provide feedback of the timekeeper's time to the timer.

[0026] Exemplary follow-up actions of the timer are explained below: One advantageous concept provides that at least one follow-up action includes a check whether the timekeeper clock is operating within a temporal tolerance range with respect to the timer clock. By comparing the timekeeper time signal in the time resynchronization message with time information generated or received from its timer clock, the timer can, for example, determine accuracy information about the accuracy of the time set at the timekeeper.

[0027] Advantageously, the system includes at least one subsequent action: the timer sends a control command to the timekeeper based on the timekeeper's time reference in the time resynchronization message. For example, the control command can contain setting information that instructs the timekeeper to adjust their clock, such as correcting the time set on the timekeeper's clock. Alternatively, the control command can specify a time for the timekeeper to retrieve information. This time can be adjusted by the timer based on the timekeeper's time reference in the time resynchronization message, allowing the timer to account for any time difference between the timekeeper's clock and the timer's clock when setting the time for retrieving the information.

[0028] Furthermore, it can be stipulated that the timer sends or withholds the control command to the timekeeper depending on whether the timekeeper's clock operates within a predefined tolerance range relative to the timer's clock. For example, it is possible that the timer only queries the timekeeper for at least one piece of information via the control command if the timekeeper's clock is within the tolerance range, while in the case of a larger deviation, the information would be useless to the timer.

[0029] However, it is also possible for the timer to select the transmission time of the control command based on the timer's time signal in the time-resynchronization message. One advantageous concept involves the timer selecting the transmission time of the control command based on a time difference between the timer's clock and the timer's clock. For example, the timer can send the control command earlier or later, so that the timer executes the control command at what is, from the timer's perspective, the correct time.

[0030] Furthermore, it is advantageous if the timer specifies an execution time for the control command based on a time difference between the timer clock and the time receiver clock. Thus, for example, the execution time of a switching command with which the timer performs a switching operation, the execution time of a sensor reading, or the like, can be optimally adjusted.

[0031] It is also possible that the timekeeper is simply informed whether the time set on their clock is correct. An advantageous concept might include at least one follow-up action: the timer sends the timekeeper information about whether the timekeeper's clock is within a time tolerance range relative to the timer's clock, and / or whether the timekeeper's clock displays a valid time accepted by the timekeeper. Based on this information, the timekeeper can, for example, determine whether they are properly synchronized.

[0032] It is advantageous if the timekeeper can send notification messages to the timekeeper. Such a notification message includes, for example, at least one piece of information separate from a timekeeper's time reading and / or at least one sensor value or status value from the timekeeper.

[0033] One consequence of an insufficiently synchronized timing setting of the timekeeper may be, for example, that the timekeeper does not send notification messages to the timekeeper or only sends them under certain conditions.

[0034] For example, it is advantageous that the timekeeper only sends notification messages to the timekeeper if the timekeeper's clock is within the time tolerance range relative to the timekeeper's clock. Otherwise, the timekeeper blocks notification messages.

[0035] Furthermore, it can be stipulated that the timekeeper only sends notification messages to the timekeeper if the timekeeper's watch displays a valid time accepted by the timekeeper. Thus, if the timekeeper signals to the timekeeper, based on the information explained above, that the time set by the timekeeper is valid, the timekeeper can then send notification messages to the timekeeper. The timekeeper, in effect, knows that the time set on their watch is correct.

[0036] As mentioned, the timer can, for example, be a control unit that receives information from various sensors on board the timekeeper. The timer function is only one part of the control unit, while other components process the sensor information. These other components receive messages from the sensors, which act as timekeepers or have software in the form of time modules to implement their timekeeper function.

[0037] It can be advantageous to have the timekeeper include information in their messages to the timekeeper indicating whether the timekeeper's clock is within the time tolerance range and / or displays the valid time. This eliminates the need for the timekeeper to constantly check whether a message is valid or invalid. InThe respective message indicates whether the sensor's timing clock is operating within the timer's tolerances or has valid times. Thus, the actual timing component of the timer is not involved in the analysis of a particular message. Rather, another component of the timer, unrelated to its timing function, can determine from the message itself whether it is valid in terms of timing.

[0038] As part of time synchronization, the timekeeper can optionally send a transmission time information message, such as a follow-up message, to the timekeeper, specifying the transmission time of the time synchronization message. Based on this transmission time information message or follow-up message, the timekeeper can essentially adjust or optimize their timekeeper clock by introducing a delay between reading the timekeeper clock (which determines the timekeeper time for the time synchronization message) and sending the time synchronization message. This additional information allows the timekeeper to adjust their timekeeper clock using both the timekeeper time and the transmission time information.It is therefore advantageous that the timer sends the timekeeper a transmission time information message after sending the time synchronization message, which contains or shows transmission time information about the time of transmission of the time synchronization message, whereby the timekeeper can set and / or correct the timekeeper's clock based on the transmission time information.

[0039] This approach is also particularly advantageous in connection with the time resynchronization message. It is advantageously provided that, after sending the time resynchronization message, the timekeeper sends the timekeeper a transmission time information message containing or indicating the transmission time of the time resynchronization message, allowing the timekeeper to set and / or correct a timekeeper monitoring clock assigned to the timekeeper based on this transmission time information.

[0040] Furthermore, it is advantageous to determine propagation delays on a transmission path between timer and timekeeper based on messages sent via the respective time synchronization or time resynchronization messages. For example, the timekeeper can send a delay request message to its timer, requesting a delay response message. In this context, delay time refers to the propagation delay resulting from the travel time of messages on the transmission path between timer and timekeeper. The timer responds to the delay request message with a delay response message.The timekeeper can use time information obtained from the communication of the delay request message and the delay response message, for example, a time difference between the delay request message and the receipt of the delay response message, to correct the time set on the timekeeper's clock by the time information, for example, the time difference.

[0041] This procedure is also possible in connection with the time resynchronization message, i.e., the timer receiving the time resynchronization message sends a delay request message to the timekeeper (which is resynchronizing), which the timekeeper answers with the delay response message, so that the timer can, for example, correct a timekeeper monitoring clock assigned to the timekeeper by time information that the timer can determine through the communication of the delay request message and the delay response message, for example, by correcting a time difference between sending the delay request message and receiving the delay response message.

[0042] At this point, it becomes clear that the time resynchronization message is advantageously not dedicated solely to determining a processing delay within the device containing the timer and / or to determining a processing delay within the device containing the timekeeper, where the processing delay is, for example, the processing time between the recording of a time from the respective timer clock or timekeeper clock. The time synchronization message or time resynchronization message is therefore different from the follow-up message or transmission time information message. Furthermore, the time synchronization message or time resynchronization message is advantageously different from a delay request message or delay response message.

[0043] The accuracy and / or reliability of the times set on the clocks of the devices or system components of the system can be increased by the following measures: To further increase the accuracy of the timekeeper clock, time synchronization messages can be repeatedly sent by the timer and / or time resynchronization messages by the timekeeper. It is possible that not every time synchronization message is linked to a time resynchronization message, or vice versa. For example, the timer can send several time synchronization messages, each of which is answered by the timekeeper with a time resynchronization message. It is also possible for the timekeeper to send several time synchronization messages to the timer, for example, periodically, cyclically, or similarly, so that the timer can monitor the timekeeper regularly in this way.It is entirely possible that the timer and / or the timekeeper send one or more of the aforementioned transmission time information messages in connection with the respective time synchronization message or time resynchronization message.

[0044] An advantageous concept provides that the at least one subsequent action includes the timer sending at least one further time synchronization message to the timekeeper to synchronize the timekeeper's clock, wherein the further time synchronization message contains time information to reduce any time deviation between the timekeeper's clock and the timer's clock. It is advantageous if the timekeeper sends further time synchronization messages to the timer periodically and / or cyclically and / or at predetermined time intervals. These intervals are preferably equal, but can also be different.

[0045] Based on at least one additional time synchronization message, particularly those sent regularly or repeatedly, the timekeeper can periodically reset their timekeeper clock and / or, if necessary, verify whether their timekeeper clock is sufficiently accurate with respect to the timer clock. Furthermore, the timekeeper can also check whether their communication with the timer is functioning correctly. For example, the timekeeper may be required to check whether they receive time synchronization messages from the timer within a predetermined time interval and / or cycle time. This enables so-called timeout monitoring.

[0046] It is further advantageous if, after receiving at least one additional time synchronization message, the timekeeper sends at least one further time resynchronization message to the timer, containing at least one timekeeper time value generated from the timekeeper clock set by the timer time value in the at least one additional time synchronization message. The timer then generates at least one further subsequent action by comparing this further timekeeper time value with time information from its timer clock. Thus, the process according to the invention, whereby the timekeeper sends a further time resynchronization message to the timer after receiving a time synchronization message, can be repeated for at least one of the further time synchronization messages.

[0047] For example, the timer can perform the following action in connection with the first or subsequent time synchronization messages. In one embodiment of the invention, the timer checks whether, after sending a time synchronization message to the timekeeper, it receives a time resynchronization message from the timekeeper who received the time synchronization message within a predetermined time.

[0048] It is understood that, advantageously, the timekeeper monitors their timer clock for function and accuracy. It is also advantageous for the timekeeper to monitor their timer clock for function and accuracy. Thus, in another embodiment of the invention, the timekeeper and / or the timekeeper monitor their timer clock for time jumps, time drift, and / or stopping. If the timekeeper or the timekeeper detects a timing error in their respective clock, for example, time jumps, drift, and / or stopping, they can inform the other component of the timekeeper and timekeeper about the timing error; that is, the timekeeper can inform the timekeeper, or vice versa.For example, the timekeeper can send a message to the timekeeper indicating that a timing error has occurred, such as their timekeeper's clock having stopped. The timekeeper can then initiate a resynchronization by sending a time synchronization message to the timekeeper.

[0049] It is advantageously provided that the timer or a device of the system containing the timer discards or ignores messages from the timekeeper or a device of the system containing the timekeeper when the timekeeper signals a timing error.

[0050] In a further embodiment of the invention, the timekeeper uses the timekeeper's clock to check whether the timer time specified in a given time synchronization message is within a tolerance range and / or plausible. For example, this method, which can also be described as leap monitoring, allows the timekeeper to recognize that they have not received a time synchronization message.

[0051] It is also advantageous if the time synchronization message and / or the time resynchronization message are accompanied by a verification code, essentially securing it. The verification code could, for example, be a cyclic redundancy check code. Even if such a verification code extends the length of the time synchronization or time resynchronization message, it improves the quality of the time setting.

[0052] The method according to the invention is scalable. The direction in which the time synchronization occurs can also be freely chosen. One concept, for example, involves the timer acting as a timer for at least one further sub-timer, wherein the timer executes the process steps of the timer as described above with respect to the sub-timer, and the sub-timer executes the process steps of the timer as described above. Thus, for example, the timer can act as a timer for the sub-timer and send it the time synchronization message, while the sub-timer sends the time resynchronization message to this timer. Such a procedure can readily be implemented with further sub-timers, so that a timer-timer cascade is possible.In this process, the respective timer and the timekeeper(s) that the respective timer synchronizes each form a time domain.

[0053] It is further advantageous if each timer has a timekeeper monitoring clock for a respective timekeeper, which is synchronized by the timer using at least one time synchronization message. Setting the timekeeper monitoring clock can constitute at least one subsequent action.

[0054] It is advantageously provided that the timer has at least one timekeeper monitoring clock, wherein the timer sets the timekeeper monitoring clock based on the timekeeper time signal in the time resynchronization message, so that the timekeeper monitoring clock displays a time corresponding to the timekeeper's clock. It is particularly preferred if the timer has one timekeeper monitoring clock for each of several timekeepers it synchronizes, preferably for each timekeeper it synchronizes, which the timer sets based on the time synchronization messages received from the respective timekeeper. Thus, the timer is always aware of the time set on the at least one timekeeper it synchronizes.It is understood that a device of the system which performs the function of a timer for one or more timekeepers and has a timekeeper monitoring clock for one or more, preferably all of these timekeepers, can also assume the role of a timekeeper that is synchronized by another timer of the system.

[0055] An embodiment of the invention is explained below with reference to the drawing. The drawing shows: Figure 1 a schematic hierarchical view of a system according to the invention, Figure 2 the system according to Figure 1 in an installation situation in a motor vehicle, Figure 3 shows a sequence of temporal synchronization of the system according to Figures 1 and 2 , and Figure 4, another communication in the system according to Figures 1 and 2 .

[0056] A system 10 according to the drawing comprises devices 11, 12, 13, 14, 15, which is in Figure 1is presented in a hierarchical representation, in Figure 2 in a physical arrangement in a motor vehicle 80. The motor vehicle 80 is a motor vehicle, for example a passenger car. The motor vehicle 80 has an engine 82, for example an internal combustion engine and / or electric motor. The engine 82, as well as the devices 11, 12, 13, 14, 15, is housed in a body 81 of the motor vehicle 80, which has wheels 83, of which, for example, the front wheels 83 are driven by the engine 82.

[0057] The devices 11, 12, 13, 14, 15 communicate with each other via a bus 85 of the motor vehicle 80.

[0058] Device 11 is, for example, a control unit for vehicle stabilization of the motor vehicle 80 and / or for its autonomous control, i.e., for at least partially automated driving. Device 12 is, for example, an engine control unit for controlling the motor 82. Devices 13, 14, and 15 are or comprise, for example, sensors. For example, device 13 has a sensor 23 in the form of a camera, device 14 has a sensor 24 in the form of a gyroscope, and device 15 has a sensor 25 in the form of a radar sensor.

[0059] The devices 11-15 each have a processor 20 and memory 21, wherein the processor 20 is connected to the bus 85 via a communication module 22, for example a so-called bus coupler, and is designed to send and receive bus messages via the bus 85.

[0060] Device 11 forms a node K1 of system 10, to which devices 12 and 13 are connected as nodes K2 and K3. Further nodes can also be connected to node K1, one of which, node KX, is shown as an example.

[0061] Devices 14 and 15 are in turn connected to node K3 as nodes K4 and K5.

[0062] Further nodes or system components located further down the hierarchy are easily possible, for example a node KY that is connected to node K5.

[0063] As explained, devices 10 to 15 can communicate with each other via a common bus 85. However, it is also possible that, for example, a first communication bus is provided between devices 11, 12 and 13 and, if applicable, node KX, and a second communication bus or transmission path, different from the first, is provided between devices 14, 15 or nodes K4 and K5.

[0064] For devices 12, 13, 14, and 15, only device 12 shows a processor 20, a memory 21, and a communication module 22. Devices 13-15 also feature processors 20, memory 21, and a communication module 22.

[0065] Furthermore, the devices 11, 12, 13, 14, 15 each have a time module 30 which contains program code that can be executed by the processor 20 of the devices 11, 12, 13, 14, 15, wherein the time modules 30 are stored in the respective memory 21 of the devices 11, 12, 13, 14, 15.

[0066] Device 11, or node K1, forms a time master or timer M1 of system 10, which synchronizes devices 11, 12, or nodes K2, K3, which are timers S1 with respect to timer M1. The timers S1, i.e., nodes K2, K3, and node K1 as timer M1, form a time domain TD1.

[0067] Synchronization of the timekeepers S1 by the node K1 or time transmitter M1 proceeds, for example, as follows: At time t1, the time transmitter M1 sends a time synchronization message SY1 to the timekeepers S1. The time synchronization message SY1 contains, for example, a header HD, a time transmitter time reference TM1, and a verification code CTR, which the timekeepers S1 can use to verify the time synchronization message SY1.

[0068] The HD1 header, for example, is used to address the timer S1. The time synchronization message SY1, and in particular the HD1 header, can also contain further information, such as information about the time domain T1, a sequence number indicating that the time synchronization message SY is the first message of a synchronization sequence, or similar information.

[0069] The time module 30 of the timer M1 determines and generates the timer time TM1 based on a timer clock CM1 of the timer M1.

[0070] At time t2, after the time synchronization message SY1, the timer M1 optionally sends a transmission time information message SY2 with a header HD2 and a verification code CTR for the timekeeper S1 to verify the transmission time information message SY2. The transmission time information message SY2 also contains a transmission time indication VM2, indicating the time of transmission of the time synchronization message SY1.

[0071] Based on the timer time specification TM1 and optionally the dispatch time specification VM2, the time modules 30 of nodes K2, K3 or timekeeper S1 represent the timekeeper clocks CS1.

[0072] The following explains a back-synchronization or feedback of the nodes K1, K2 relationship side timer S1 with respect to the timer M1.

[0073] Nodes K2 and K3 form timers M2 and M3 with respect to node K1, which in turn forms timekeepers S2 and S3 in relation to timers M2 and M3. Node K1 has a timekeeper clock CS2 and CS3 for each of nodes K2 and K3, which represents a timekeeper monitoring clock.

[0074] Using the timers M2 and M3 as examples, the resynchronization using the timer M2 is explained below.

[0075] At time t3, timer M2 sends a time resynchronization message SY3 with a header HD3, a timekeeper time TM3, and a verification code CTR, where the header HD3 and the verification code CTR are functionally equivalent to, for example, the header HD1 and the verification code CTR. The timekeeper time TM3 is generated from the timekeeper clock CS1 and represents its current time. Alternatively, the timekeeper time TM3 can be generated from a timekeeper clock CM2, which is assigned to timer M2 and is set, for example, synchronously with or analogously to the timekeeper clock CS1.

[0076] At time t4, the timer M2 optionally sends a transmission time information message SY4, which is fundamentally and functionally equivalent to the transmission time information message SY2. This includes, for example, a header HD4 corresponding to header HD2, a verification code CTR, and a transmission time indication VM4, which, analogous to the transmission time indication VM2, specifies the time of transmission of the time resynchronization message SY3. Based on the transmission time indication VM4 and the timekeeper time indication TM3, node K1, specifically time module 30, sets the timekeeper clock CS2 assigned to timer M2. Thus, timer M2 and timekeeper S2 form a time domain TD2.

[0077] The node K3 forms a timer M3 of a time domain TD3, which has several timers S3, namely a timer S3 at node K1 and further timers S3 at nodes K4 and K5.

[0078] In the manner described above, it is possible for node K3, or its time module 30, to implement the timer M3, to send a time resynchronization message SY5 to node K1 at time t5 and a transmission time information message SY6 at time t6, which contain headers HD5 and HD6, verification code CTR, a timer time indication TM5 and a transmission time indication VM6, based on which node K1, in particular, sets the time module 30, a timer clock CS3 assigned to node K3 in its function as timer M3.

[0079] Furthermore, nodes K4 and K5 are timekeepers S3 with respect to node K3 and timer M3, respectively. Time modules 30 of nodes K4 and K5 have timekeeper clocks CS3 assigned to timer M3.

[0080] For example, node K3 or timer M3 sends the time resynchronization message SY5 or a time synchronization message SY5' substantially equivalent to it to node K4 and node K5, which have their timekeeper clocks CS3 assigned to timer M3, which set the timekeepers S3 or nodes K4, K5 based on the time resynchronization message SY5, which is essentially a time synchronization message with respect to nodes K4 and K5, and the transmission time information message SY6.

[0081] Nodes K4 and K5 can act not only as timers but also as timers, for example, timers M4 and M5. In their function as timers M4 and M5, nodes K4 and K5 have timer clocks CM4 and CM5. Node K1 has timers S4 and S5, which can be synchronized by timers M4 and M5.

[0082] If the timers M4 and M5 synchronize the timers S4 and S5 of node K1, then a resynchronization of node K1 by timers S4 and S5 is possible. Thus, nodes K2, K3, K4, and K5 synchronize node K1, or rather, the clocks that node K1 maintains and monitors for nodes K2-K5.

[0083] Based on the timer clocks CM4 and CM5 or time information generated from them, the timers M4 and M5 send time synchronization messages to the node K1, so that its time modules 30 can set the timer clocks CM4 and CM5.

[0084] For example, at times t7 and t8, timer M4 sends a time synchronization message SY7, which can also be called a time-back synchronization message, and a transmission time information message SY8 to node K1, which represents timer M1. This message contains, as explained, headers HD7 and HD8 for addressing node K1 and verification codes CTR. Furthermore, time synchronization message SY7 contains a timer time reference TM7, and transmission time reference VM8 is included in the transmission time information message SY8. For the sake of simplicity, a time synchronization message sent by node K5 and a transmission time information message also sent by K5 are not shown in the diagram.The time module 30 of node K1 sets the timekeeper clocks CS4 and CS5 assigned to the timers M4 and M5 based on the time synchronization message SY and the time synchronization message not shown, which can also be considered a time resynchronization message, as well as the transmission time information message SY8 and the transmission time information message not shown of node K5 or timer M5.

[0085] In connection with the synchronization of nodes K1-K5 and / or as a result of synchronization and resynchronization, the following exemplary situations arise: For example, the timer M1 checks, by comparing the timer clock CM1 with one of the timekeeper clocks CS2, CS3, CS4, or CS5, whether they are within a time tolerance range with respect to the timer clock CM1. For this purpose, the timer M1, in particular module 30, compares the respective time displayed on the timer clock CM1 with the time displayed on the respective timekeeper clock CS2, CS3, CS4, or CS5.

[0086] However, it is also entirely possible for the timer M1 or the time module 30 to compare the time TCM1 present at the timer clock CM1 with the time receiver time TM3 received as part of the time resynchronization message SY3, for example forming a time difference TDI = TCM1-TM3.

[0087] For example, node K1 sends an information message IN10 with a header HD10, a verification code CTR, and the time difference TDI, which indicates whether the timekeeper clock CS1 is within a time tolerance range relative to the time transmitter clock CM1. Can the value for the time difference TDI be invalid if it lies outside a time tolerance range?

[0088] If the difference TCM1 - TM3 is less than a limit value Tmax, node K1, for example, sends a control message C9 to node K2 at time t9, which contains a header HD9, a verification code CTR and a control command CD.

[0089] The control command CD, for example, directs node K2 to send a message M11 at time t11, which is contained in the control message C9. This message M11 contains a header HD11, a verification code CTR, message information MI, and the capture time TMI of the message information MI. If the capture time TMI is specified with an invalid value, this signals node K1 that the message information MI was captured outside a time tolerance range with respect to the timer clock CM1. Thus, node K1 can recognize that the message information MI is invalid and unusable.

[0090] To illustrate that time synchronization and time resynchronization are advantageously repeated, the time synchronization message SY12 and the time resynchronization message SY13 are shown, containing headers HD12 and HD13 and verification codes CTR.

[0091] For example, at time t12, the timer M1 sends the time synchronization message SY12 with a timer time TM12 generated from the timer clock CM1, where time t12 has a period or cycle interval from time t1.

[0092] The time resynchronization message SY13 contains a timekeeper time indication TM13, which is generated using the timekeeper clock CS1.

[0093] If timer S1 does not receive further time synchronization messages from timer M1 within a time window containing time t12, i.e., not within a certain period or cycle time, timer S1 sends, for example, a message SY14 to timer M1 with a header HD14, a verification code CTR, and information TER indicating a time synchronization error or incomplete time synchronization. Timer S1 thus checks whether it is being synchronized by timer M1 within a predetermined cycle time.

Claims

1. Method for time synchronization in a system (10), comprising a time master (M1, M2) and at least one time slave (S1, S2), wherein the time master has a time master clock (CM1, CM2) and the time slave (S1, S2) has a time slave clock (CS1, CS2), wherein the time master (M1, M2) transmits to the time slave (S1, S2) a time synchronization message (SY1) with a time master time indication (TM1) - generated on the basis of the time master clock (CM1, CM2) - for synchronizing the time slave clock (CS1, CS2) with the time master clock (CM1, CM2), wherein the time slave (S1, S2) sets its time slave clock (CS1, CS2) on the basis of the time master time indication (TM1) of the time synchronization message (SY1), wherein the time slave (S1, S2) transmits to the time master (M1, M2) a time back-synchronization message (SY3) with at least one time slave time indication (TM3), wherein the time back-synchronization message (SY3) is generated on the basis of the time slave clock (CS1, CS2) set by means of the time master time indication (TM1) of the time synchronization message (SY1), and wherein the time master (M1, M2) generates at least one follow-up action on the basis of a comparison of the time slave time indication (TM3) with time information of the time master clock (CM1, CM2), characterized in that the time master (M1, M2) checks whether, after sending a time synchronization message (SY1) to the time slave (S1, S2), the time master obtains within a predetermined time a time back-synchronization message (SY3) from the time slave (S1, S2) that received the time synchronization message (SY1), and / or in that the time master (M1, M2) monitors its time master clock (CM1, CM2) and / or the time slave (S1, S2) monitors its time slave clock (CS1, CS2) for temporal jumps and / or temporal drift and / or stopping and / or in that the time slave (S1, S2) checks on the basis of the time slave clock (CS1, CS2) whether the time master time indication (TM1) indicated in a respective time synchronization message (SY1) is within a tolerance range and / or is plausible.

2. Method according to Claim 1, characterized in that the at least one follow-up action comprises a check as to whether the time slave clock (CS1, CS2) is operating in a temporal tolerance range with respect to the time master clock (CM1, CM2).

3. Method according to Claim 1 or 2, characterized in that the at least one follow-up action comprises the time master (M1, M2) sending a control command (CD) to the time slave (S1, S2) depending on the time slave time indication (TM3) of the time back-synchronization message (SY3), wherein it is advantageously provided that the time master (M1, M2) transmits or does not transmit the control command (CD) to the time slave (S1, S2) depending on whether the time slave clock (CS1, CS2) is operating in a predefined temporal tolerance range with respect to the time master clock (CM1, CM2), and / or that the time master (M1, M2) selects a transmission instant of the control command depending on a time difference between the time master clock (CM1, CM2) and the time slave clock (CS1, CS2) and / or indicates an execution instant for executing the control command depending on a time difference between the time master clock (CM1, CM2) and the time slave clock (CS1, CS2) in the control command.

4. Method according to any of the preceding claims, characterized in that the at least one follow-up action comprises the time master (M1, M2) transmitting to the time slave (S1, S2) information (TDI) about whether the time slave clock (CS1, CS2) is within a temporal tolerance range with respect to the time master clock (CM1, CM2) and / or the time slave clock (CS1, CS2) has a valid time accepted by the time slave (S1, S2).

5. Method according to any of the preceding claims, characterized in that the time slave (S1, S2) transmits reporting messages (M11) to the time master (M1, M2) only if the time slave clock (CS1, CS2) is within the temporal tolerance range with respect to the time master clock (CM1, CM2) and / or has a valid time accepted by the time master (M1, M2), and / or in that the time slave (S1, S2) provides reporting messages (M11) to the time master (M1, M2) with information indicating whether the time slave clock (CS1, CS2) is within the temporal tolerance range and / or has the valid time.

6. Method according to any of the preceding claims, characterized in that the at least one follow-up action comprises the time master (M1, M2) transmitting to the time slave (S1, S2) at least one further time synchronization message (SY12) for synchronizing the time slave clock (CS1, CS2), wherein the further time synchronization message (SY12) contains time information for reducing a temporal deviation between the time slave clock (CS1, CS2) and the time master clock (CM1, CM2), wherein it is advantageously provided that the time slave (S1, S2) checks whether it obtains time synchronization messages (SY1) from the time master (M1, M2) within a predetermined temporal interval and / or within a predetermined cycle time, and / or that the time slave (S1, S2), after obtaining the at least one further time synchronization message (SY1), transmits to the time master (M1, M2) at least one further time back-synchronization message (SY13) with at least one time slave time indication (TM13) generated on the basis of the time slave clock (CS1, CS2) set by means of the time master time indication (TM1) in the at least one further time synchronization message (SY1), wherein the time master (M1, M2) generates at least one further follow-up action on the basis of a comparison of this further time slave time indication (TM13) with time information of its time master clock (CM1, CM2).

7. Method according to any of the preceding claims, characterized in that the time synchronization message (SY1) and / or the time back-synchronization message (SY3) have / has a check code, in particular a CRC code (CRC = cyclic redundancy check).

8. Method according to any of the preceding claims, characterized in that the time slave (S1, S2) forms a time master (M1, M2) for at least one further sub-time slave (S1, S2), wherein the time slave (S1, S2) executes the method steps of the time master (M1, M2) according to any of the preceding claims with respect to the sub-time slave (S1, S2) and the sub-time slave (S1, S2) executes the method steps of the time slave (S1, S2) according to any of the preceding claims.

9. Method according to any of the preceding claims, characterized in that the time master (M1, M2) has at least one time slave monitoring clock (CS2, CS3), wherein the time master (M1, M2) sets the time slave monitoring clock (CS2, CS3) on the basis of the time slave time indication (TM3) of the time back-synchronization message (SY3), so that the time slave monitoring clock (CS2, CS3) has a clock time corresponding to the time slave clock (CS2, CS3) of the time slave (S1, S2), wherein it is advantageously provided that the time master (M1, M2) has a time slave monitoring clock (CS2, CS3) for each time slave (S1, S2) synchronized by it and sets the time slave monitoring clocks (CS2, CS3) on the basis of the time back-synchronization messages (SY3) obtained from the respective time slave (S1, S2).

10. Method according to any of the preceding claims, characterized in that the time back-synchronization message (SY3) is a message which is separate from reporting messages of the time slave (S1, S2) and which serves exclusively for the feedback of the time slave time indication (TM3) to the time master (M1, M2), and / or in that the time synchronization message (SY1) is formed according to the AUTOSAR standard or the IEEE-1588 standard.

11. Method according to any of the preceding claims, characterized in that the time master (M1, M2) transmits to the time slave (S1, S2), after sending the time synchronization message (SY1), a sending time information message (SY2) containing sending time information (VM2) about the instant of sending the time synchronization message (SY1), wherein the time slave (S1, S2) can set and / or correct the time slave clock (CS1, CS2) on the basis of the sending time information (VM2) the time slave clock (CS1, CS2) and / or in that the time slave (S1, S2) transmits to the time master (M1, M2), after sending the time back-synchronization message (SY3), a sending time information message (SY4) containing sending time information (VM4) about the instant of sending the time back-synchronization message (SY3), wherein the time master (M1, M2) can set and / or correct a time slave monitoring clock (CS2, CS3) assigned to the time slave (S1, S2) on the basis of the sending time information (VM4).

12. System (10) for time synchronization, wherein the system (10) comprises a time master (M1, M2) and at least one time slave (S1, S2), wherein the time master (M1, M2) has a time master clock (CM1, CM2) and the time slave (S1, S2) has a time slave clock (CS1, CS2), wherein the time master (M1, M2) has transmission means for transmitting to the time slave (S1, S2) a time synchronization message (SY1) with a time master time indication (TM1) - generated on the basis of the time master clock (CM1, CM2) - for synchronizing the time slave clock (CS1, CS2) with the time master clock (CM1, CM2), wherein the time slave (S1, S2) has setting means for setting its time slave clock (CS1, CS2) on the basis of the time master time indication (TM1) of the time synchronization message (SY1), the time slave (S1, S2) has transmission means for transmitting to the time master (M1, M2) a time back-synchronization message (SY3) (SY3) with at least one time slave time indication (TM3), wherein the time back-synchronization message (SY3) is generated on the basis of the time slave clock (CS1, CS2) set by means of the time master time indication (TM1) of the time synchronization message (SY1), and wherein the time master (M1, M2) has generation means for generating at least one follow-up action on the basis of a comparison of the time slave time indication (TM3) with time information of the time master clock (CM1, CM2), characterized in that the time master (M1, M2) checks whether, after sending a time synchronization message (SY1) to the time slave (S1, S2), the time master obtains within a predetermined time a time back-synchronization message (SY3) from the time slave (S1, S2) that received the time synchronization message (SY1), and / or in that the time master (M1, M2) monitors its time master clock (CM1, CM2) and / or the time slave (S1, S2) monitors its time slave clock (CS1, CS2) for temporal jumps and / or temporal drift and / or stopping and / or in that the time slave (S1, S2) checks on the basis of the time slave clock (CS1, CS2) whether the time master time indication (TM1) indicated in a respective time synchronization message (SY1) is within a tolerance range and / or is plausible.