Very high precision clock module controlled by a reference signal and including a phase integrity verification system

Abstract

The invention relates to a clock module comprising a precision main oscillator generating a first clock signal of predetermined frequency, a receiver module of a time reference, provided for example by a satellite positioning system, capable of delivering, when it is active, a time reference signal to which the main oscillator is slaved, and means for detecting a failure of the main oscillator or of the time reference signal comprising - a second oscillator of an electronic component of the clock module delivering a second clock signal of predetermined frequency, and - processing means capable of measuring a first phase difference (xor) between the first clock signal delivered by the main oscillator and the time reference signal delivered by the receiver module,a second phase difference (xho) between the first clock signal delivered by the main oscillator and the second clock signal delivered by the second oscillator, and a third phase difference (xhr) between the time reference signal delivered by the receiver module and the second clock signal delivered by the second oscillator, said processing means being capable of calculating the first-order derivatives of the three measured phase differences so as to determine the respective variations of the three phase differences. Figure for the abstract: Fig. 1,

Description

Title of the invention: Very high precision clock module controlled by a reference signal and comprising a phase integrity verification system Technical field

[0001] The field of the invention is that of time references, in particular that of very high precision clocks.

[0002] More specifically, the invention relates to a clock circuit / module suitable as a time and frequency reference in digital electronic equipment (a radiolocation device, for example). Prior art

[0003] An increasing number of applications, for example mobile telephony, radiolocation, digital broadcasting, wireless telecommunications, etc., rely on reliable time and / or frequency references. The devices used in these applications integrate oscillator clock modules, such as a thermostatically controlled quartz oscillator (OCXO) which is a very high performance oscillator.

[0004] These very precise oscillators are not, however, without defects.

[0005] Thus, the frequency of such oscillators is subject to variations which depend on the operating conditions of the oscillator, in particular the temperature variations, wear and vibrations to which the oscillator is subjected.

[0006] To compensate for these drifts and synchronize these devices in the time domain, it is known to implement in the clock modules a receiver of a satellite positioning system capable of delivering, when it is active, a time reference signal so as to slave the internal / local precision oscillator (OXCO for example) of the module, called the main oscillator, with a reference signal provided by the clock of a global navigation satellite system GNSS (in English for "Global Navigation Satellite System"), such as the GPS, Galileo, GLONASS, BEIDU or other system. The GNSS system (which is also not exempt from faults or vulnerabilities of the jamming type) is therefore used as a reference to limit this drift of the clock and its internal / local precision oscillator.

[0007] Furthermore, random failures (breakdowns) can occur on the main oscillator of the device, as on any electronic component. Since clocks slaved to a time reference such as GNSS are generally used to synchronize critical infrastructures or systems, they must be designed to be functionally safe and must always operate correctly and predictably.

[0008] To overcome this problem, it is known to implement two oscillators of the same type or even three. This redundancy, however, generates additional costs.

[0009] If the system relies on the time reference signal, such as GNSS, to maintain accuracy and the GNSS signal (e.g., GPS) fails due to loss of lock, weather, jamming, or other issues, these clock modules are capable of maintaining the 1 PPS (pulse per second) or other periodic signal delivered by the precision local oscillator aligned with minimal drift until lock to the time reference is restored.

[0010] Although failures of GNSS time references are very rare, serious problems or spoofing events can occur.

[0011] In the event of an integrity problem (failure) on the reference or main oscillator side, such a clock must remain safe for users, i.e. it must continue to provide stable and accurate time to users.

[0012] Identifying the origin of a failure is particularly important for designing fault-tolerant clocks controlled by a time reference such as GNSS. If the failure is on the GNSS reference side, the control on this reference must be immediately stopped before the effect of the failure propagates and the clock can then rely on the stability of its main oscillator. On the other hand, if the failure is on the main oscillator side, users must be warned that maintenance or replacement of the main oscillator is necessary.

[0013] When slaving a main oscillator such as an OCXO or an atomic clock to a reference such as GNSS, the instantaneous time difference (or phase difference) between the two signals delivered by the main oscillator and the time reference is the main feedback information used by the main oscillator control system. The reliability of this phase difference throughout the slaving process is therefore crucial. Under normal circumstances, fluctuations in the phase difference are observed with amplitude and periodicity characteristics depending on the noises of the reference and the main oscillator. However, abnormal behavior of the reference or the main oscillator would result in sudden and unexpected phase fluctuations or drifts.The key question then is whether the problem is on the reference side, or whether it is a stability or accuracy issue with the main oscillator.

[0014] It can sometimes be difficult to identify where the problem comes from (either on the main oscillator side or on the reference side).

[0015] To resolve this problem of integrity of the reference or of the main precision oscillator, solutions of a high level of complexity have been proposed, such as software layers which call upon the analysis of messages from the receiver to detect problems with the GNSS system (GPS for example).

[0016] Currently, there is no simple way to detect faults.

[0017] An objective of the invention is therefore to untangle a confusing situation (when we do not know where the problem comes from) and the good functioning from the bad, in a simple and rapid manner. Statement of the invention

[0018] The invention meets this need by proposing a clock module comprising a precision main oscillator generating a first clock signal of predetermined frequency, a module for receiving a time reference, provided for example by a satellite positioning system, capable of delivering, when it is active, a time reference signal to which the main oscillator is slaved, and means for detecting a failure of the main oscillator or of the time reference signal comprising - a second oscillator of an electronic component of the clock module delivering a second clock signal of predetermined frequency, and - processing means capable of measuring a first phase difference between the first clock signal delivered by the main oscillator and the time reference signal delivered by the receiver module,a second phase difference between the first clock signal delivered by the main oscillator and the second clock signal delivered by the second oscillator, and a third phase difference between the time reference signal delivered by the receiver module and the second clock signal delivered by the second oscillator, said processing means being capable of - calculating the first-order derivatives of the three measured phase differences so as to determine the respective variations of the three phase differences, - comparing the values ​​of the calculated first-order derivatives with a predetermined threshold value and - detecting a failure of the main oscillator when the values ​​of the first-order derivative of the first phase difference and of the second phase difference are each greater than said predetermined threshold value,or a failure of the time reference signal when the values ​​of the derivative of the first phase difference and the derivative of the third phase difference are each greater than said predetermined threshold value.

[0019] The solution of the invention is implemented on a very high precision clock which uses a reference signal, such as that received from a GNSS satellite positioning system for example, as an external time reference on which is controls the local precision oscillator of the clock, called the main oscillator. The invention proposes to use a so-called opportunity oscillator already present in a clock module to detect integrity problems of the precision oscillator of the clock module (OXCO oscillator for example) or of the time reference reception system (GNSS for example), without additional cost and without adding any component. Almost every printed circuit board has at least one cheap oscillator to synchronize a microprocessor, FPGA circuits or Ethernet interfaces, for example. The opportunity oscillator (which provides the frequency of a microprocessor, any microprocessor needing an oscillator) is used as a relatively constant reference frequency signal over a short period (but not very precise and stable over a few minutes and hours).It is proposed, in order to detect a failure and resolve this problem of integrity of the reference or the main oscillator, to measure several phase differences, namely: - the phase difference between for example the two 1 PPS (pulse per second) signals delivered by the main oscillator and the GNSS reference, - the phase difference between the two signals delivered by the local oscillator and the opportunity oscillator of the microprocessor, and - the phase difference between the two signals delivered by the GNSS reference for example and the opportunity oscillator of the microprocessor.

[0020] The first derivatives of these phase differences are then calculated, which amounts to obtaining a variation in frequency (in other words, the derivative is used to determine the variations in the phase difference), and if the absolute value of two of these derivatives is greater than a predetermined threshold, a maintenance alert is launched (main precision oscillator faulty) or the servocontrol is stopped because it is considered that the reference is no longer valid (time reference faulty). The idea is not to train the clock and its main oscillator if there is a problem with the reference and not to let the main precision oscillator disturb the quality of the time it delivers without knowing it and without warning the user.

[0021] Abnormal behavior of the reference or the precision main oscillator results in sudden phase fluctuations or drifts and such potential phase integrity problems are detected by taking advantage of a third party (so-called opportunity) oscillator already present in the clock module, such as the clock of a microprocessor integrated in the clock module. Therefore, another redundant oscillator is used to determine whether the problem is on the reference side or on the main oscillator side.

[0022] The solution of the invention thus makes it possible to disentangle or untangle (“disen-tangling” in English) a confusing situation (in which it is not clear whether the problem comes from the reference or the main oscillator) in a simple and hassle-free manner. additional cost.

[0023] It should be noted that the very high precision clock is controlled by a reference signal which is not necessarily a GNSS type satellite signal but which can be a reference signal delivered by any other time reference source, such as by a reference clock according to the PTP protocol (for "Precision Time Protocol" in English), a local atomic clock or other.

[0024] According to a particular aspect of the invention, said processing means of the clock module are further capable of calculating the second-order derivatives of the three measured phase differences and of detecting a failure of the main oscillator when the second-order derivative of the third phase difference is equal to 0 and the second-order derivatives of the first and second phase differences are non-zero, or a failure of the time reference signal when the second-order derivative of the second phase difference is equal to 0 and the second-order derivatives of the first and third phase differences are non-zero. The first derivatives being dependent on the drift constant of the opportunity oscillator which is not controlled or measured a priori, this is avoided by using the second derivatives according to a particular implementation of the invention. According to a particular aspect of the invention,the processing means are configured to stop controlling the main oscillator when a failure of the time reference signal is detected and to issue an alert when a failure of the main oscillator is detected. According to a particular aspect of the invention, the second oscillator of the clock module is that of a microprocessor, an FPGA integrated circuit or an Ethernet interface of the clock module. According to a particular aspect of the invention, the receiver module is capable of receiving a time reference delivered by a GNSS type satellite positioning system,by a reference clock according to the PTP protocol or by a local atomic clock. The invention also relates to a method for detecting a failure of the main oscillator or of the time reference signal in a clock module as described above comprising a precision main oscillator generating a first clock signal of predetermined frequency, a module receiving a time reference, provided for example by a satellite positioning system, capable of delivering, when it is active, a time reference signal to which the main oscillator is slaved, means for detecting a failure of the main oscillator or of the time reference signal comprising a second oscillator of an electronic component of the clock module delivering a second clock signal of predetermined frequency,and processing means capable of implementing the steps of - measuring a first phase difference between the first clock signal delivered by the main oscillator and the time reference signal, delivered by the receiver module, of a second phase difference between the first clock signal delivered by the main oscillator and the second clock signal delivered by the second oscillator, and of a third phase difference between the time reference signal delivered by the receiver module and the second clock signal delivered by the second oscillator, - of calculating the first-order derivatives of the three measured phase differences so as to determine the respective variations of the three phase differences, - of comparing the values ​​of the first-order derivatives calculated with a predetermined threshold value and of detecting a failure of the main oscillator when the values ​​of the first-order derivative of the first phase difference and of the second phase difference are each greater than said predetermined threshold value,or a failure of the time reference signal when the values ​​of the derivative of the first phase difference and the third phase difference are each greater than said predetermined threshold value. According to a particular aspect of the invention, the first clock signal, the time reference signal and the second clock signal are 1PPS, 10PPS or 1PPM signals. The invention further relates to a computer program comprising instructions for implementing the method as described above, when the program is executed by a processor. Presentation of figures

[0025] Other aims, characteristics and advantages of the invention will appear more clearly on reading the following description, given as a simple illustrative, and non-limiting, example, in relation to the figures, among which: among which:

[0026] [Fig-1] is a schematic view of a clock module according to the invention;

[0027] [Fig.2] is a comparison of frequency accuracy over a period of 60s of the precision oscillator OCXO of a clock module according to the invention and another oscillator of the clock module, called opportunity oscillator, allowing the implementation of the invention.

[0028] Detailed description of an embodiment of the invention

[0029] [Fig.l] schematically shows a clock module 1 with an internal precision oscillator 12, called the main oscillator or precision oscillator or local oscillator, which can be a thermostated quartz type oscillator (OCXO oscillator) or an atomic clock, generating a first clock signal of predetermined frequency. This clock module 1 is used here as a time and frequency reference in digital electronic equipment 2 (a radiolocation device, for example).

[0030] This clock module 1 further comprises a GNSS frequency receiver module 11 capable of delivering, when it is active, a synchronization signal for example 1PPS (pulse per second) time reference which is derived from the synchronization information transmitted by GNSS (or other) satellite systems, to which the main oscillator 12 is slaved.

[0031] To do this, the clock module 1 implements a system for controlling the main oscillator 12 comprising a first phase detector 14A measuring the instantaneous time difference (or phase difference) between the two 1PPS (or other) signals of the main oscillator 12 and the GNSS reference, and a software algorithm 15B intended to compensate for the drifts of the main oscillator 12.

[0032] Under normal circumstances, fluctuations in the phase difference are observed and corrected by the main oscillator control system 12. However, abnormal behavior of the reference or the main oscillator would result in sudden and unexpected phase fluctuations or drifts. The key question then is whether the problem is on the reference side, or whether it is a stability or accuracy problem of the main oscillator.

[0033] The approach of the invention consists in taking advantage of an oscillator already present in the clock module, such as the clock of the microprocessor for example. For example, in the latest generation of clocks from the applicant of the present application, the microprocessor called HPS (for "Hard Processor System" in English) is embedded in an FPGA integrated circuit. The HPS microprocessor is clocked by a MEMS oscillator, called opportunity oscillator hereinafter, providing a frequency signal of 25 MHz from which it is possible to generate a 1PPS signal or any other periodic signal. Obviously, the clock of another component of the clock module can be used within the framework of the invention.

[0034] Such an opportunity oscillator, although having a different initial purpose and showing much lower performances than the main oscillator dedicated to synchronization, is here used as a comparison tool for the main oscillator / reference system assembly. To do this, the solution of the invention consists in constantly monitoring the phase difference (x^) between the 1PPS signal generated by the opportunity oscillator (here HPS) and the 1PPS signal generated by the reference, as well as the phase difference (xho) between the 1PPS signal by the opportunity oscillator (here HPS) and the 1PPS signal generated by the main oscillator, in addition to the phase difference (xor ) between the 1PPS signal generated by the main oscillator and the 1PPS signal generated by the reference.

[0035] The phase measurements are therefore carried out from the 1PPS signals (the difference at the rising edge of each PPS signal is measured) by three phase detectors, called first, second and third phase detectors 14A, 14B and 14C, integrated in the aforementioned FPGA integrated circuit. The second phase detector 14B measures the phase difference between the two 1PPS signals of the reference and the opportunity oscillator 13, the third phase detector 14C measuring the phase difference between the two signals of the main oscillator 12 and the opportunity oscillator 13.

[0036] In normal operation, the difference (or sum depending on the sign convention) xho - xhr corresponds to the phase difference xor between the 1PPS signal of the main oscillator and the 1PPS signal of the reference. An oscillator of opportunity like the HPS oscillator is not servo-controlled. Therefore, the values ​​of x^ and xho are arbitrary and can drift quickly because the frequency accuracy of such an oscillator of opportunity is typically of the order of 106 to 105. However, its instantaneous frequency drift is negligible over short periods (seconds to tens of seconds). This behavior is illustrated in [Fig.2]. It is this key assumption that allows unraveling the origin of a phase problem, the oscillator of opportunity being used as a relatively constant reference frequency signal.

[0037] [Fig.2] is a comparison of frequency accuracy over a period of 60s of the opportunity oscillator of the HPS microprocessor and the main precision oscillator OCXO of a clock module used during tests carried out by the applicant.

[0038] The top curve represents the relative frequency (“fractional frequency difference” in English) of the opportunity oscillator of the HPS microprocessor over a period of 60s.

[0039] The bottom curve represents the relative frequency of the precision oscillator OCXO which is the main oscillator of the clock and which is stable in the short term. We see that there are more than two orders of magnitude separating them in accuracy, the opportunity oscillator being less exact (both being relatively stable over 60s). Even if the relative frequency of the opportunity oscillator is not exact and drifts over long time intervals, it can be considered constant over short time intervals as visible in [Fig.2]. It is this point which is used to implement the solution of the invention.

[0040] Abnormal behavior of the reference or the main oscillator leads to sudden phase fluctuations or drifts. The key question then is whether the problem is on the reference side, or whether it is a stability or accuracy issue with the main oscillator. As previously highlighted, such potential phase integrity issues are detected by taking advantage of a third-party oscillator already present in the clock module, such as the microprocessor clock. Therefore, another redundant oscillator is used to determine whether the problem is on the reference side or the main oscillator side.

[0041] The phase measurements mentioned above are carried out at the level of an FPGA circuit and the analysis of these measurements is ensured by an algorithm 15A of the [Fig.l] whose main stages are as follows: - we recover the three phase values, namely the phase value between the main oscillator and the reference, the phase value between the opportunity oscillator and the main oscillator and the phase value between the opportunity oscillator and the reference; - we store them in a table; - their first derivatives are calculated using a first approach, and their second derivatives also using a second approach, in terms of finite differences, which amounts to estimating the relative frequency differences and their variations; - the absolute values ​​of the first derivatives according to the first approach are compared to a pre-determined threshold value, and when this threshold value is exceeded, an alert is launched (defective main oscillator) or the main oscillator is stopped from being controlled because the reference is considered to be no longer valid.

[0042] More precisely, according to the first approach, the successive phase derivatives (which are equivalent to the relative frequency) over a sampling period r are calculated in terms of first-order finite differences, as follows:

[0043] [Math.l] ---------- Ch - &xo (t) + wko(t), (1) riw(t) = ............. k Ch - + WhAt'h (2) T = ~ + (3)

[0044] where w represents random noise, Ch is the relative frequency error of the opportunity oscillator (fractional frequency difference) of the HPS microprocessor which is considered constant over the sampling interval r, and A XQrl(t) is the frequency command applied to the main oscillator.

[0045] The frequency variation is assumed to be constant. A sudden change in the value of the frequency variation indicates a malfunction. In the case of a faulty reference signal, the derivatives %hr and *or are impacted while the derivative is not. In the case of a faulty main oscillator signal, the derivatives Xho and -L^ are impacted while the derivative is not. Thus, if the absolute values ​​of the derivatives ^hr and *»r are each greater than a predetermined threshold value and the absolute value of the derivative Xho is less than said predetermined threshold value, then it is determined that the reference signal is faulty and the holdover mode is engaged. If the absolute values ​​of the If the Xho and -é- derivatives are each greater than a predetermined threshold value and the absolute value of the Xhl derivative is less than said predetermined threshold value, then it is determined that the main oscillator is probably faulty and a disciplining degraded mode is engaged.

[0046] If none of these conditions are met but a significant phase difference is calculated (i.e. if the difference of the derivatives and Xhr is non-zero at the noise resolution), a problem is detected and an alert is issued without the source of the problem (reference or main oscillator) being able to be identified.

[0047] If no sudden change in the frequency variation values ​​is calculated, then the main clock continues to be controlled by the reference (“normal disciplining mode” in English).

[0048] Thus, according to a first approach, the observation of identical simultaneous variations on two phase derivatives while the third phase derivative is not impacted allows the identification of an integrity problem.

[0049] However, since the drift constant of the opportunity oscillator is unknown and not controlled by design, the algorithm implementation with previously established thresholds is not absolutely reliable.

[0050] According to a second approach, the algorithm applies to the second derivatives of the phase series (and therefore equivalent to a relative frequency drift) and not only to the first derivatives of the phase series (which are equivalent to the relative frequency). Thus, in order to avoid the calculation of Ch and to make the detection of a malfunction more reliable, the second approach consists of calculating the second derivatives of the phase values ​​(or frequency variation) in terms of second-order finite differences as follows:

[0051] [Math.2] .. Xho(t) - ~t) + Xhott - 2r) , ^(t) =---------------2----------- «WO, T » M _ ^(0 " ~ r) + æhr(t - 2t) v J 2 ““ v J .. ,,, z6r(t) ~ 2æor(t~r) - 2r) , ■J

[0052] where w'or, w'h, and w'ho are random noises assumed to be Gaussian and centered on 0.

[0053] In the case of a faulty reference signal, and -will take a non-zero value while will retain a zero value at the resolution of the Gaussian noise. In the case of a faulty main oscillator signal, Xiwet é will take a non-zero value while will retain a zero value at the resolution of the Gaussian noise. The threshold conditions previously described are then adapted without need to estimate Ch, the relative frequency error of the opportunity oscillator. The analysis of the second derivatives of the phases with threshold conditions therefore allows the identification of an integrity problem more reliably than the first approach.

[0054] The first algorithm 15A receives and stores the three phase differences transmitted by the first, second and third phase detectors 14A, 14B and 14C respectively and calculates their first derivatives according to the first approach and their secondary derivatives also according to the second approach. It also implements the processing steps detailed previously. On the basis of these calculated data, a second algorithm 15B controls the main oscillator 12 by means of control instructions and makes it possible to compensate for the drifts of the main oscillator as is known in the prior art. The phase integrity verification system comprises the three phase detectors, the opportunity oscillator and the first algorithm 15A.

[0055] The solution of the invention is without additional cost and allows to detect in a reactive manner a problem (defect of the reference or of the main oscillator). It requires to make comparisons by constructing phase differences (i.e. time differences) from two received frequencies. Every second, the phase interval between the main oscillator and the reference is measured. The same is done between the main oscillator and the opportunity oscillator, and between the reference and the opportunity oscillator. By analyzing their short-term evolutions, it is possible to determine whether there is an integrity problem on one side or the other.

[0056] The solution of the invention further improves resistance to faults and jamming. It allows the detection of integrity problems (jamming - radio waves emitted in the GNSS frequencies which conceal the GNSS signal or prevent its proper reception by the clock module which cannot give the time or at least which delivers an imprecise time). The precision of the time given by GNSS tends to relax in the event of jamming until the receiver (GPS for example) no longer gives the time. As this sequence can be quite long before this happens, this imprecise time continues to be used and the accuracy of the clock is harmed (since the reference becomes imprecise). The solution makes it possible to do without the reference in the event of a fault of this type (it is better not to use the reference than to use an imprecise or misleading reference).

[0057] The invention can implement any phase comparison, not only based on 1PPS signals. The phase measurement can be implemented for 10PPS (10 pulses per second), 1PPM (1 pulse per minute) signals or for any other periodic signal.

Claims

Claims

1. Clock module (1) comprising a main oscillator (12) of precision dedicated to synchronization and generating a first clock signal of predetermined frequency, a receiver module (11) of a time reference, provided for example by a satellite positioning system, capable of delivering, when it is active, a time reference signal to which the main oscillator (12) is slaved, and means for detecting a failure of the main oscillator (12) or of the time reference signal comprising - a second oscillator (13) not slaved to an electronic component of the clock module (1) delivering a second clock signal of predetermined frequency relatively constant over a short period, and - processing means capable of measuring a first phase difference (xOT) between the first clock signal delivered by the main oscillator (12) and the time reference signal delivered by the receiver module,a second phase difference (xho) between the first clock signal delivered by the main oscillator (12) and the second clock signal delivered by the second oscillator, and a third phase difference (x^) between the time reference signal delivered by the receiver module and the second clock signal delivered by the second oscillator (13), said processing means being capable of calculating the first-order derivatives of the three measured phase differences so as to determine the respective variations of the three phase differences, of comparing the values ​​of the first-order derivatives calculated with a predetermined threshold value and of detecting a failure of the main oscillator (12) when the values ​​of the first-order derivative of the first phase difference (xor) and of the second phase difference (xho) are each greater than said predetermined threshold value,or a failure of the time reference signal when the values ​​of the derivative of the first phase difference (xOT) and the third phase difference (xhr) are each greater than said predetermined threshold value.,

2. A clock module according to claim 1, wherein said processing means is further adapted to calculate the second-order derivatives of the three measured phase differences and to detect a failure of the main oscillator when the second-order derivative of the third phase difference (xhr) is equal to 0 and the second-order derivatives of the first and second phase differences (xor xho) are non-zero, or a failure of the time reference signal when the second-order derivative of the second phase difference (xho) is equal to 0 and the second-order derivatives of the first and third phase differences (xor xhr) are non-zero.

3. A clock module according to claim 1 or 2, wherein the processing means are configured to stop slaving the main oscillator when a failure of the time reference signal is detected and to issue an alert when a failure of the main oscillator is detected.

4. Clock module according to one of claims 1 to 3, wherein the second oscillator is that of a microprocessor, an FPGA integrated circuit or an Ethernet interface of the clock module.

5. Clock module according to one of claims 1 to 4, in which the receiver module is capable of receiving a time reference delivered by a GNSS type satellite positioning system, by a reference clock according to the PTP protocol or by a local atomic clock.

6. Method for detecting a failure of the main oscillator or of the time reference signal in a clock module according to one of claims 1 to 5 comprising a precision main oscillator dedicated to synchronization and generating a first clock signal of predetermined frequency, a module receiving a time reference, provided for example by a satellite positioning system, capable of delivering, when it is active, a time reference signal to which the main oscillator is slaved, means for detecting a failure of the main oscillator or of the time reference signal comprising a second non-slaved oscillator of an electronic component of the clock module delivering a second clock signal of predetermined frequency relatively constant over a short period,and processing means capable of implementing the steps of - measuring a first phase difference (xOT) between the first clock signal delivered by the main oscillator and the time reference signal delivered by the receiver module, a second phase difference (xho) between the first clock signal delivered by the main oscillator and the second clock signal delivered by the second oscillator, and a third phase difference (xhr) between the time reference signal delivered, by the receiver module and the second clock signal delivered by the second oscillator, - calculating the first-order derivatives of the three measured phase differences so as to determine the respective variations of the three phase differences, - comparing the values ​​of the calculated first-order derivatives with a predetermined threshold value and detecting a failure of the main oscillator when the values ​​of the first-order derivative of the first phase difference (xor) and of the second phase difference (xho) are each greater than said predetermined threshold value, or a failure of the time reference signal when the values ​​of the derivative of the first phase difference (xOT) and of the third phase difference (xhr) are each greater than said predetermined threshold value.

7. The method of claim 6, wherein the first clock signal, the time reference signal, and the second clock signal are 1PPS, 10PPS, or 1PPM signals.

8. A computer program comprising instructions for implementing the method according to claim 6 or 7, when the program is executed by a processor.

Images