Time synchronization system, time verification device, and time verification method

Abstract

This time verification device comprises a verification execution unit and a result transmission unit. The verification execution unit generates verification information for verifying a synchronized state of a local time and a global time for each of one or more slave devices on the basis of master verification information received from a master device and slave verification information received from each of the one or more slave devices. The result transmission unit transmits the verification information generated by the verification execution unit to each of the master device and the one or more slave devices.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This international application claims priority based on Japanese Patent Application No. 2022-074975, filed with the Japan Patent Office on April 28, 2022, the entire contents of which are incorporated by reference into this international application. [Technical field]

[0002] The present disclosure relates to techniques for verifying time synchronization of each node in a network. [Background technology]

[0003] A known time synchronization protocol using Ethernet is a technology in which a master node distributes its own time to slave nodes in a time synchronization system, thereby synchronizing the time of the slave nodes with the time of the master node. Ethernet is a registered trademark.

[0004] In a time synchronization system, there is a possibility that a slave node may synchronize to an unintended time due to corruption or tampering of time information. In order to detect such anomalies, for example, Non-Patent Document 1 describes a technology that detects anomalies by estimating the state of a time synchronization network from the message contents after receiving a time synchronization message multiple times. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Avnu Automotive Technical Working Group, “Automotive Ethernet AVB Functional and Interoperability Specification Revision 1.6”, [online], November 7, 2019, [Retrieved April 20, 2022], Internet <URL:https: / / avnu.org / wp-content / uploads / 2014 / 05 / Auto-Ethernet-AVB-Func-Interop-spec_v1.6.pdf> Summary of the Invention

[0006] However, in the conventional technology described in the above non-patent document 1, a problem was found in that the time synchronization message sent when an abnormality occurs must be received multiple times, and it takes time for the abnormality to be detected.

[0007] One aspect of the present disclosure provides a technique for quickly verifying the state of time synchronization of each node belonging to a time synchronization system.

[0008] One aspect of the present disclosure is a time synchronization system including a master device, one or more slave devices, and a time verification device, the master device, the one or more slave devices, and the time verification device being connected via a communication network.

[0009] The master device includes a synchronization message transmission unit and a master information transmission unit. The synchronization message transmission unit is configured to repeatedly transmit to each of the one or more slave devices a synchronization message including a transmission time indicated in a global time counted by a clock possessed by the master device. The master information transmission unit is configured to transmit master verification information including the transmission time of the synchronization message to the time verification device.

[0010] The slave device includes a synchronization execution unit and a slave information transmission unit. The synchronization execution unit is configured to perform time synchronization to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by a global time based on information obtained by receiving a synchronization message. The slave information transmission unit is configured to transmit slave verification information including information used for time synchronization by the synchronization execution unit to the time verification device.

[0011] The time verification device includes a verification execution unit and a result transmission unit. The verification execution unit is configured to generate verification information for verifying a synchronization state between a local time and a global time for each slave device based on master verification information received from the master device and slave verification information received from each of the one or more slave devices. The result transmission unit is configured to transmit the verification information generated by the verification execution unit to each of the one or more slave devices.

[0012] According to this configuration, one or more slave devices can quickly determine the time synchronization state of their own local times with respect to the global time, using the verification information.

[0013] A time verification device according to an embodiment of the present disclosure is used in a time synchronization system. The time synchronization system includes a master device and one or more slave devices connected via a communication network. The time synchronization system is configured to perform time synchronization to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by a global time counted by a clock of the master device.

[0014] The time verification device includes a verification execution unit and a result transmission unit. The verification execution unit is configured to generate verification information for verifying a synchronization state between a local time and a global time for each slave device based on master verification information received from the master device and slave verification information received from each of the one or more slave devices. The result transmission unit is configured to transmit the verification information generated by the verification execution unit to each of the one or more slave devices. The master verification information includes a transmission time of a synchronization message indicated in global time. The slave verification information is obtained by receiving a synchronization message and includes information used for time synchronization.

[0015] With this configuration, it is possible to quickly verify the time synchronization in the time synchronization system.

[0016] A time verification method according to an embodiment of the present disclosure is applied to a time synchronization system including a master device, one or more slave devices, and a time verification device, all of which are connected via a communication network.

[0017] The master device repeatedly transmits a synchronization message including a transmission time indicated in global time counted by a clock of the master device to each of one or more slave devices, and transmits master verification information including the transmission time of the synchronization message to the time verification device.

[0018] The slave device performs time synchronization based on the information obtained by receiving the synchronization message, to synchronize the time indicated by the local time counted by the clock of the slave device with the time indicated by the global time, and transmits slave verification information including the information used for the time synchronization to the time verification device.

[0019] The time verification device generates verification information for verifying the synchronization state between the local time and the global time for each slave device based on the master verification information received from the master device and the slave verification information received from each of the one or more slave devices, and transmits the generated verification information to each of the one or more slave devices.

[0020] According to this method, it is possible to quickly verify the time synchronization in the time synchronization system. [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 is a block diagram showing a configuration of a time synchronization system. [Diagram 2] FIG. 11 is a sequence diagram showing an overview of time synchronization and time verification. [Diagram 3] FIG. 1 is an explanatory diagram showing a method of time synchronization. [Figure 4] 11 is a list showing the contents of a TMTR table provided in the master ECU. [Diagram 5] 11 is a table showing the contents of a TSTR table provided in a bridge ECU and a slave ECU. [Figure 6] FIG. 11 is an explanatory diagram of parameters used for time synchronization and time verification. [Figure 7] 4 is a table showing the contents of an STBR table provided in a bridge ECU and a slave ECU. [Figure 8] 1 is a list showing the contents of a VD table provided in a time verification ECU. [Figure 9] 13 is a flowchart of a master time process. [Figure 10] 13 is a flowchart of a bridge time process. [Figure 11] 13 is a flowchart of a slave time process. [Figure 12] 13 is a flowchart of a time verification process. [Figure 13] 13 is a flowchart of a modified example of the time verification process. [Figure 14]13 is a flowchart of a modified example of the time verification process. [Figure 15] FIG. 13 is a block diagram showing another example of the configuration of the time synchronization system. [Figure 16] FIG. 13 is a block diagram showing another example of the configuration of the time synchronization system. [Figure 17] FIG. 11 is an explanatory diagram showing information contained in a message used for time synchronization and time verification. [Figure 18] 11 is a flowchart of a verification confirmation process in the first embodiment. [Figure 19] 13 is a flowchart of a verification confirmation process in the second embodiment. [Figure 20] 13 is a flowchart of master time processing in the third embodiment. [Figure 21] 13 is a flowchart of establishment determination processing in the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0023] [1. First embodiment] [1-1. Configuration] 1 is a communication network using in-vehicle devices, and includes a master electronic control unit (hereinafter, referred to as master ECU) 10, a bridge ECU 20, a plurality of slave ECUs 30, and a time verification ECU 40. The bridge ECU 20 includes a relay device such as an Ethernet switch or a gateway.

[0024] The time synchronization system 1 may include an external device interface 50 for connecting an external diagnostic tool 60. In this embodiment, the external device interface 50 is connected to the bridge ECU 20. The external device interface 50 may be, for example, a USB connector.

[0025] The master ECU 10, the multiple slave ECUs 30, and the time verification ECU 40 are connected to the bridge ECU 20 via individual signal lines. In other words, the master ECU 10, the multiple slave ECUs 30, and the time verification ECU 40 form a star-shaped network with the bridge ECU 20 at the center. An Ethernet communication protocol is used for communication between the ECUs 10 to 40 via the signal lines. Ethernet is a registered trademark. Note that the communication protocol is not limited to Ethernet, and may be a communication protocol such as Controller Area Network (hereinafter, CAN) or FlexRay. CAN and FlexRay are registered trademarks.

[0026] In the time synchronization system 1, time synchronization is performed to synchronize local times used in the bridge ECU 20 and each of the multiple slave ECUs 30 with a global time used in the master ECU 10. For example, the IEEE1588 Precision Time Protocol (hereinafter, PTP) may be used for the time synchronization.

[0027] In response to a request from an external diagnostic tool 60 connected to an external device interface 50, the bridge ECU 20 provides the external diagnostic tool 60 with information transmitted and received between the ECUs 10 to 40 for time synchronization and time verification.

[0028] The master ECU 10 is an electronic control device mainly composed of a microcomputer including a CPU 11 and a memory 12 such as a ROM and a RAM. Various functions of the microcomputer are realized by the CPU 11 executing a program stored in a non-transient real recording medium. In this example, the ROM corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU may be configured in hardware form using one or more ICs or the like. The number of microcomputers constituting the master ECU 10 may be one or more. The bridge ECU 20, the slave ECU 30, and the time verification ECU 40 are also similar to the master ECU 10. Hereinafter, when the master ECU 10, the bridge ECU 20, the slave ECU 30, and the time verification ECU 40 are collectively referred to as the ECUs 10 to 40.

[0029] [1-2. Overview of time synchronization] An overview of the time synchronization performed in the time synchronization system 1 will be described.

[0030] Each of the ECUs 10 to 30 that are targets of time synchronization has a local clock that operates independently.

[0031] The master ECU 10 uses a master local time and a global time. Both the master local time and the global time are kept according to a local clock of the master ECU 10. The master local time indicates a time specific to the master ECU 10 and is used for measuring time intervals, etc. The global time may indicate a time different from the master local time.

[0032] The bridge ECU 20 and the multiple slave ECUs 30 use slave local time and synchronous local time, respectively. Both the slave local time and the synchronous local time are kept according to the local clock of each ECU 20, 30. The slave local time indicates a unique time in each of the bridge ECU 20 and the multiple slave ECUs 30, and is used for measuring time intervals, etc. The synchronous local time may indicate a time different from the slave local time.

[0033] Time synchronization means that the time indicated by the synchronous local time in each of the bridge ECU 20 and the multiple slave ECUs 30 is adjusted to the time indicated by the global time of the master ECU 10. Applications that use time and are executed in each of the ECUs 10 to 30 use the time indicated by the global time or the synchronous local time synchronized with the global time.

[0034] Each of the ECUs 10 to 30 stores delay information PD that is set based on a transmission delay time (hereinafter, MB delay time) between the master ECU 10 and the bridge ECU 20, and a transmission delay time (hereinafter, SB delay time) between each slave ECU 30 and the bridge ECU 20. The delay information PD may be a value (i.e., a fixed value) measured at the time of shipment or the like, or may be a value (i.e., a variable value) measured according to a predetermined procedure at a predetermined timing such as when the system is started up.

[0035] As shown in Figures 2 and 17, a first synchronization message SY and a second synchronization message FU are used in time synchronization. Also, a master record notification message MM, a bridge record notification message BM, a slave record notification message SM, and a result notification message VM are used in time verification. All of these messages SY, FU, MM, BM, SM, and VM are messages handled in the application layer of the TCP / IP model, and communication is performed by TCP or UDP.

[0036] The master ECU 10 periodically transmits a first synchronization message SY to the bridge ECU 20. Following the first synchronization message SY, the master ECU 10 transmits a second synchronization message FU. The second synchronization message FU is added with a global transmission time OT, which is called a follow-up message and is time information that accurately represents the transmission time of the first synchronization message SY in nanosecond units in global time.

[0037] The master ECU 10 may transmit the first synchronization message SY to the bridge ECU 20 when a preset first transmission condition is satisfied, and thereafter, may periodically transmit the first synchronization message SY. The first transmission condition may include starting the master ECU 10, or a predetermined time has elapsed since starting the master ECU 10. The first transmission condition may include turning on the power supply, ignition (hereinafter, IG), or accessory (hereinafter, ACC) of the vehicle, and a predetermined time has elapsed since the power supply, IG, or ACC is turned on. Furthermore, the first transmission condition may include, in addition to the above-mentioned first transmission condition, the master ECU 10 confirming the start of the bridge ECU 20 and the slave ECU 30 that receive the first synchronization message SY.

[0038] The master ECU 10 may determine whether the bridge ECU 20 and the slave ECU 30 are activated, for example, by determining whether a predetermined frame from the slave ECU 30 is received via the bridge ECU. Note that the transmission interval of the first synchronization message SY that is periodically transmitted does not need to be permanently constant, and the master ECU 10 may control the transmission interval based on a result of verification of time synchronization, which will be described later.

[0039] When the bridge ECU 20 receives the first synchronization message SY, it transfers the message to each of the slave ECUs 30. Here, the number of slave ECUs 30 is m. The bridge ECU 20 adds a retention delay time CF to the first synchronization messages SY-1 to SY-m to be transferred to the slave ECUs 30. The retention delay time CF is a measurement value of the time required for the bridge ECU 20 to transmit the first synchronization messages SY-1 to SY-m to each slave ECU 30 after receiving the first synchronization message SY from the master ECU 10.

[0040] When the bridge ECU 20 receives the second synchronization message FU, the bridge ECU 20 transfers the second synchronization message FU to each of the m slave ECUs 30.

[0041] 6, when the bridge ECU 20 and each slave ECU 30 receive the first synchronization message SY, they acquire a first local reception time LT1, which is a timestamp indicating the reception time. When the bridge ECU 20 and each slave ECU 30 receive the second synchronization message FU, they acquire a second local reception time LT2, which is a timestamp indicating the reception time. Both the first local reception time LT1 and the second local reception time LT2 are time information that accurately indicates the reception time in the slave local time in nanosecond units.

[0042] The bridge ECU 20 and each slave ECU 30 perform time synchronization using information obtained by receiving the first synchronization message SY and the second synchronization message FU, respectively.

[0043] As shown in Fig. 3, the global time and the synchronous slave time use different local clocks, so even if the times are synchronized and operated, the time deviation increases over time. Therefore, in time synchronization, the reference global time GT0 and the rate correction value Rate are calculated according to information obtained by receiving the first synchronization message SY and the second synchronization message FU, and the time SLT(t) represented by the synchronous local time is calculated according to equation (1).

[0044]

number

[0045] The rate correction value Rate is the increase per unit time in the deviation between the time represented by the global time and the time represented by the synchronous slave time, and in Figure 3, it corresponds to the slope of the line representing the synchronous slave time relative to the line representing the global time.

[0046] LT(t) is the current time expressed in slave local time, and LT0 is the reference global time TG0 expressed in slave local time.

[0047] [1-3. Overview of time verification] An overview of the time verification performed in the time synchronization system 1 will be described.

[0048] To perform time verification, each of the ECUs 10 to 30 records information related to time synchronization in a table. As shown in FIG. 2, after transmitting the second synchronization message FU, the master ECU 10 transmits a master record notification message MM including the information recorded in the table (hereinafter, time record information) to the time verification ECU 40 via the bridge ECU 20. After transferring the second synchronization message FU, the bridge ECU 20 transmits a bridge record notification message BM including the time record information to the time verification ECU 40. After receiving the second synchronization message FU, each of the slave ECUs 30 transmits slave record notification messages SM-1 to SM-m including the time record information to the time verification ECU 40 via the bridge ECU 20. Hereinafter, when the slave record notification messages SM-1 to SM-m are described without making a distinction, they will be referred to as slave record notification messages SM.

[0049] The master ECU 10 transmits a master record notification message MM to the time verification ECU 40 via the bridge ECU 20 when a preset second transmission condition is satisfied. The second transmission condition may include a predetermined time having elapsed since the transmission of the second synchronization message FU, or a predetermined time having elapsed since the transmission of the second synchronization message FU multiple times. Furthermore, the second transmission condition may include a specific condition, which will be described later.

[0050] The bridge ECU 20 also transmits a bridge record notification message BM to the time verification ECU 40 when a preset third transmission condition is satisfied. The third transmission condition may include a predetermined time lapse from the transfer of the second synchronization message FU, or a predetermined time lapse from the transfer of the second synchronization message FU multiple times. Furthermore, the third transmission condition may include a specific condition, which will be described later.

[0051] Moreover, the slave ECU 30 transmits the slave record notification message SM to the time verification ECU 40 via the bridge ECU 20 when a preset fourth transmission condition is satisfied. The fourth transmission condition may include a predetermined time having elapsed since the reception of the second synchronization message FU, or a predetermined time having elapsed since the reception of the second synchronization message FU a plurality of times. Furthermore, the fourth transmission condition may include a specific condition, which will be described later.

[0052] The transmission timings of the master record notification message MM, the bridge record notification message BM, and the slave record notification message SM must be synchronized among the ECUs 10 to 30. For example, assume that the master ECU 10 transmits the master record notification message MM a predetermined time after transmitting the second synchronization message FU twice. In this case, the bridge ECU 20 must transmit the bridge record notification message BM to the time verification ECU 40 a predetermined time after performing a transfer process for transferring the second synchronization message FU to all the slave ECUs 30 twice. In addition, the slave ECU 30 must transmit the slave record notification message SM a predetermined time after receiving the second synchronization message FU twice.

[0053] The master ECU 10 may transmit the first synchronization message SY or the second synchronization message FU to which information requesting verification of time synchronization is added, so that each of the ECUs 10 to 30 may know whether or not it is necessary to transmit the master record notification message MM, the bridge record notification message BM, and the slave record notification message SM. Details will be described later.

[0054] The time verification ECU 40 performs a process of verifying the time using the time record information received from each of the ECUs 10 to 30, and transmits a result notification message VM including the verification result to each of the ECUs 10 to 30. Specifically, the time verification ECU 40 transmits a result notification message VM including the verification result to the bridge ECU 20. Then, the bridge ECU 20, which has received the result notification message VM, transmits result notification messages VM-0 to VM-m to the master ECU 10 and the slave ECU 30.

[0055] [1-4. Time record information] [1-4-1.TMTR table] A Timesync Master Timing Record (hereinafter, abbreviated as TMTR) table in which the master ECU 10 records time record information will be described.

[0056] As shown in FIG. 4, the TMTR table records a sequence identifier SID, a source port identifier PID, a local transmission time MLT, and a global transmission time OT.

[0057] The sequence identifier SID is an identifier of a sequence used by the master ECU 10 to transmit a time synchronization message, and its value is incremented by one each time the master ECU 10 transmits a first synchronization message SY.

[0058] The source port identifier PID is an identifier of the port used by the master ECU 10 to transmit the time synchronization message, and a fixed value is used.

[0059] The local transmission time MLT is a time stamp indicating the transmission time of the first synchronization message SY, and is time information expressed in master local time.

[0060] The global transmission time OT is a time stamp indicating the transmission time of the first synchronization message SY and is time information expressed in global time. The global transmission time OT is calculated based on the local transmission time MLT using a formula for converting the master local time to global time.

[0061] [1-4-2.TSTR table] A Timesync Slave Timing Record (hereinafter, abbreviated as TSTR) table in which the bridge ECU 20 and each slave ECU 30 record time record information will be described.

[0062] As shown in FIG. 5, the TSTR table records a sequence identifier SID, a source port identifier PID, a first local reception time LT1, a global transmission time OT, a residence delay time CF, a transmission delay time PD, a second local reception time LT2, and a reference global time GT0.

[0063] The sequence identifier SID, the source port identifier PID, and the delay residence time CF are information extracted from the received first synchronization message SY.

[0064] As shown in FIG. 6, the first local reception time LT1 is a time stamp indicating the reception time of the first synchronization message SY, and is time information expressed in slave local time.

[0065] The first local reception time LT2 is a time stamp indicating the reception time of the second synchronization message FU, and is time information expressed in slave local time.

[0066] The global transmission time OT is information extracted from the received secondary synchronization message FU.

[0067] The transmission delay time PD is a value obtained by a measurement that is performed separately. However, in the bridge ECU 20, the transmission delay time PD is the MB delay time that is the transmission delay time between the master ECU 10 and the bridge ECU 20. In the slave ECU 30, the transmission delay time PD is the sum of the SB delay time that is the transmission delay time between the bridge ECU 20 and the slave ECU 30 and the MB delay time.

[0068] The reference global time GT0 is time information calculated using equation (2) with the reception timing of the second synchronization message FU as the reference point and the global time of the reference point. Note that the (n) attached to the parameter indicates that the value is obtained in the nth sequence.

[0069]

number

[0070] As shown in Figure 7, the STBR table records a domain identifier DID, a clock frequency Hwf, a clock division number Hwp, a reference global time GT0, a time synchronization status TBS, a local time LT2n, a clock deviation value RD, a reference synchronization local time SLT0 before synchronization, and a total path delay PDL.

[0071] The domain identifier DID is an identifier that is assigned in accordance with the network structure of the time synchronization system 1, and a fixed value is used.

[0072] The clock frequency Hwf is the frequency of the local clock, and a fixed value is used.

[0073] The clock division number Hwp is the division number of the local clock required to generate a unit time of the slave local time, and a fixed value is used.

[0074] The reference global time GT0 is the same as that recorded in the TSTR table, except that the reference global time GT0 is recorded in two parts: the upper 32 bits are represented in seconds and are called GT0s, and the lower 32 bits are represented in nanoseconds and are called GT0n.

[0075] The local time LT2n is the lower 32 bits of the second local reception time LT2, expressed in nanoseconds.

[0076] Reference synchronization local time SLT0 is time information calculated by using equation (3) for the synchronization local time SLT at the reference point. At the reference point, the synchronization local time SLT is synchronized with the global time GT, but the reference synchronization local time SLT0(n) is the value before synchronization, and the reference synchronization local time SLT(n-1) is the value after synchronization. The same applies to the following equations (5) and (6).

[0077]

number

[0078] The clock deviation RD is expressed by equation (4). The clock deviation RD is obtained by modifying the time deviation TD expressed by equation (5). The time deviation TD is the time difference between the global time and the synchronous local time that occurs from the reference point in the previous sequence to the reference point in the current sequence. The clock deviation RD expressed by equation (4) is the value obtained by dividing the right side of equation (5) by the second term on the right side of equation (5) (i.e., the time interval between the reference points expressed in synchronous local time) and converting it into PPM units. In other words, Rate is the rate correction value used in equation (1) explained in the time synchronization, and is expressed by equation (6). In other words, the rate correction value Rate is the value obtained by dividing the first term on the right side of equation (5) (i.e., the time interval between the reference points expressed in global time) by the second term on the right side of equation (5).

[0079]

number

[0080]

number

[0081] The advance determination flag is a flag that is set to ON when the time offset OF(n) calculated by equation (8) is OF(n)<-TH with respect to the time threshold TH, that is, when the advance of the synchronized local time with respect to the global time exceeds the allowable value. Note that GT0 is calculated according to equation (2), and SLT0 uses the value calculated according to equation (3).

[0082]

number

[0083] The advance determination flag and the delay determination flag may be set based on the time deviation TD(n) calculated by the formula (5) and the rate correction value Rate.

[0084] [1-4-4.VD table] A description will be given of a Validate Data (hereinafter, abbreviated as VD) table in which the validation results are recorded by the time validation ECU 40. The VD table is generated individually for the bridge ECU 20 and each of the slave ECUs 30.

[0085] As shown in FIG. 8, the VD table includes a time offset OF, a clock deviation RD, a residence delay time CF, a transmission delay time PD, a slave delay time SDL, a first synchronization message reception interval SYint, and a slave status SS.

[0086] In the following, the time record information included in the master record notification message MM is referred to as master record information, and the time record information included in the bridge record notification message BM and the slave record notification message SM is referred to as slave record information.

[0087] The time offset OF is calculated according to formula (8). However, GT0 is calculated according to formula (9) using OT included in the master record information acquired in this sequence and CF, PD, RD, LT1, and LT2 included in the slave record information acquired in this sequence. However, Rate is calculated according to formula (10) using RD.

[0088]

number

[0089]

number

[0090]

number

[0091] The slave delay SDL is calculated according to equation (13) using LT1 and LT2 included in the slave record information acquired in the current sequence.

[0092]

number

[0093]

number

[0094] The slave status SS is similar to the time synchronization status TBS determined by each of the bridge ECU 20 and the slave ECU, and the result of performing a determination process similar to that of the time synchronization status TBS using information included in the record information is recorded.

[0095] 17, the time record information recorded in the TMTR table is transmitted from the master ECU 10 to the time verification ECU 40 by a master record notification message MM. The time record information recorded in the TSTR table and the STBR table is transmitted from the bridge ECU 20 or a slave ECU to the time verification ECU 40 by a bridge record notification message BM or a slave record notification message SM. The verification result recorded in the VD table is transmitted from the time verification ECU 40 to each of the ECUs 10 to 30 by a result notification message VM.

[0096] [1-5. Processing] [1-5-1. Master ECU] The master time process executed by the master ECU 10 for time synchronization and time verification will be described with reference to the flowchart of FIG.

[0097] The master time process is executed repeatedly when the system is started.

[0098] In step (hereinafter, S) 110, the master ECU 10 determines whether it is time to transmit the first synchronization message SY, and if it is time to transmit the message, the process proceeds to S120, and if it is not time to transmit the message, the process waits by repeating the same step. The timing of transmitting the first synchronization message SY may be controlled by the master ECU 10 based on a verification result described later.

[0099] In S120, the master ECU 10 generates and transmits a first synchronization message SY. The first synchronization message SY includes a sequence ID and a source port ID. The sequence ID is incremented every time the master ECU 10 transmits the first synchronization message SY.

[0100] In the next step S130, the master ECU 10 acquires a local transmission time MLT that represents the transmission time of the first synchronization message SY in master local time, and records the acquired local transmission time MLT in the TMTR table together with the sequence identifier SID and the source port identifier PID to be written in the first synchronization message SY.

[0101] In the next step S140, the master ECU 10 converts the local transmission time MLT into a global transmission time OT expressed in global time, and records the global transmission time OT in the TMTR table.

[0102] In the next step S150, the master ECU 10 generates and transmits a second synchronization message FU. The second synchronization message FU includes the global transmission time OT.

[0103] In the next step S160, the master ECU 10 generates a master record notification message MM and transmits it to the time verification ECU 40. The master record notification message MM may include all the information recorded in the TMTR table as time record information.

[0104] In the next step S170, the master ECU 10 executes a verification process and ends the master time process.

[0105] Here, the verification and confirmation process executed by the master ECU 10 at S170 will be described with reference to the flowchart of FIG.

[0106] When the verification confirmation process is started, in S210, the master ECU 10 determines whether or not a result notifying message VM has been received, and if so, proceeds to S230, and if not, proceeds to S220.

[0107] In S220, the master ECU 10 determines whether or not the reply allowable time has elapsed since transmitting the master record notification message MM. If the reply allowable time has not elapsed, the process returns to S210. If the reply allowable time has elapsed, the process proceeds to S240.

[0108] In S230, the master ECU 10 checks the contents of the result notification message VM to determine whether the synchronization state is normal or not, and ends the process if the synchronization state is normal, and shifts the process to S240 if the synchronization state is abnormal. The result notification message VM may include all the information recorded in the VD table by the time verification ECU 40.

[0109] In S240, the master ECU 10 performs a process to deal with the abnormality and then ends the process. As a process to deal with the abnormality, for example, the transmission of the first synchronization message SY, the second synchronization message FU, and the master record notification message MM may be stopped.

[0110] [1-5-2. Bridge ECU] The bridge time process executed by the bridge ECU 20 for time synchronization and time verification will be described with reference to the flowchart of FIG.

[0111] The bridge time process is executed repeatedly when the system is started.

[0112] In S310, the bridge ECU 20 determines whether or not the first synchronization message SY has been received, and if so, proceeds to S330, and if not, proceeds to S320.

[0113] In S320, the bridge ECU 20 determines whether or not the allowable upper limit time has elapsed since the previous reception of the first synchronization message SY, and if the allowable upper limit time has elapsed, the process proceeds to S450, and if the allowable upper limit time has not elapsed, the process returns to S310.

[0114] In S330, the bridge ECU 20 acquires a first local reception time LT1 that represents the reception time of the first synchronization message SY in slave local time. The bridge ECU 20 also records the acquired first local reception time LT1 in the TSTR table together with the sequence identifier SID and the source port identifier PID extracted from the first synchronization message SY.

[0115] In the next step S340, the bridge ECU 20 measures a residence delay time CF of the first synchronization message SY in the bridge ECU 20, imparts the measured residence delay time CF to the first synchronization message SY, and transfers the message to each slave ECU 30. The bridge ECU 20 also records the residence delay time CF in the TSTR table.

[0116] Next, in S350, the bridge ECU 20 determines whether or not a second synchronization message FU has been received, and if so, proceeds to S370, and if not, proceeds to S360.

[0117] In S360, the bridge ECU 20 determines whether the allowable waiting time has elapsed since receiving the first synchronization message SY, and if the allowable waiting time has elapsed, transitions processing to S450, and if the allowable waiting time has not elapsed, returns processing to S350.

[0118] In S370, the bridge ECU 20 acquires a second local reception time LT2 that represents the reception time of the second synchronization message FU in slave local time. The bridge ECU 20 records the acquired second local reception time LT2 in the TSTR table together with the global transmission time OT extracted from the second synchronization message FU.

[0119] In the following S380, the bridge ECU 20 transfers the second synchronization message FU to each slave ECU 30.

[0120] In the next step S390, the bridge ECU 20 executes time synchronization and recording in the STBR table based on the contents recorded in the TSTR table. The bridge ECU 20 performs time synchronization by updating the reference global time GT0 and the rate correction value Rate used in calculating the synchronous local time by equation (1). The bridge ECU 20 also calculates the reference global time GT0, the reference synchronous local time SLT0, the slave local time LT2n of the reference point, the clock deviation RD, and the total path delay PDL, and determines the time synchronization status TBS, and records the calculation results and the determination results in the STBR table.

[0121] In the next step S400, the bridge ECU 20 generates a bridge record notification message BM and transmits it to the time verification ECU 40. The bridge record notification message BM may include all the information recorded in the TSTR table and the STBR table as time record information.

[0122] In the next step S410, the bridge ECU 20 determines whether or not the result notification message VM has been received, and if so, proceeds to step S430, otherwise proceeds to step S420. The result notification message VM may include all of the information recorded in the VD table by the time verification ECU 40.

[0123] In S420, the bridge ECU 20 determines whether or not the reply allowable time has elapsed since transmitting the bridge record notification message BM, and if not, returns the process to S410, and if so, transitions to S440.

[0124] In S430, the bridge ECU 20 checks the contents of the result notification message VM and determines whether the synchronization state is normal or not. If the synchronization state is normal, the process ends, and if the synchronization state is abnormal, the process proceeds to S440.

[0125] In S440, the bridge ECU 20 executes a process for dealing with the abnormality in the time synchronization and ends the process. As a process for dealing with the abnormality, for example, the process related to the time synchronization may be stopped.

[0126] In S450, the bridge ECU 20 determines that the master ECU 10 has an abnormality, and executes a substitute process of transmitting the first synchronization message SY and the second synchronization message FU in place of the master ECU 10. In the substitute process, the bridge ECU 20 regards the synchronous local time of the bridge ECU 20 as the global time, and executes a process similar to the main time process in the master ECU 10.

[0127] [1-5-3. Slave ECU] The slave time process that the slave ECU 30 executes for time synchronization and time verification will be described with reference to the flowchart of FIG.

[0128] The slave time process is executed repeatedly when the system is started.

[0129] The slave time processing omits S320, S340, S360, S380, and S450 from the bridge time processing.

[0130] In addition, in S310, if the slave ECU 30 has not received the first synchronization message SY, the slave ECU 30 waits by repeating the same step. If the slave ECU 30 has received the first synchronization message SY, the slave ECU 30 shifts the process to S330. The process content of S330 is the same as S330 in the bridge time process described above. After executing the process of S330, the slave ECU 30 shifts the process to S350.

[0131] In S350, if the slave ECU 30 has not received the second synchronization message FU, the slave ECU 30 waits by repeating the same step. If the slave ECU 30 has received the second synchronization message FU, the slave ECU 30 shifts the process to S370. The process content of S370 is the same as S330 in the bridge time processing described above. After executing the process of S370, the slave ECU 30 shifts the process to S390. The process content of S390 is the same as S390 in the bridge time processing described above. After executing the process of S390, the slave ECU 30 shifts the process to S400.

[0132] In S400, the slave ECU 30 transmits a slave record notification message SM instead of a bridge record notification message BM. However, the contents of the slave record notification message SM are the same as those of the bridge record notification message BM. The processing contents of steps S410, S420, S430, and S440 after S400 are the same as those of the bridge time processing steps S410, S420, S430, and S440 described above.

[0133] [1-5-4. Time Verification ECU] The time verification process executed by the time verification ECU will be described with reference to the flowchart of FIG.

[0134] The slave time process is executed repeatedly when the system is started.

[0135] In S510, the time verification ECU 40 determines whether or not a master record notification message MM has been received. If so, the process proceeds to S520. If not, the process waits by repeating the same step.

[0136] In S520, the time verification ECU 40 determines whether or not a bridge record notification message BM or a slave record notification message SM has been received, and if so, proceeds to S530; if not, the time verification ECU 40 waits by repeating the same step.

[0137] In S530, the time verification ECU 40 performs time verification on the verification target ECU, regarding the source of the received bridge record notification message BM or slave record notification message SM as the verification target ECU, and records the verification result in the VD table. That is, based on the global transmission time OT acquired from the master ECU 10 and the time record type information acquired from each of the verification target ECUs 20 to 30, the synchronization state of the synchronous local time of each of the ECUs 20 to 30 with respect to the global time is verified.

[0138] In the next S540, the time verification ECU 40 determines whether or not time verification has been completed for the bridge ECU 20 and all of the slave ECUs 30. If so, the process proceeds to S550. If not, the process returns to S520.

[0139] In S550, the time verification ECU generates and transmits a result notification message VM, and ends the process. The result notification message VM may include all information recorded in the VR tables prepared for the bridge ECU 20 and each of the slave ECUs 30.

[0140] The bridge ECU 20 transfers the result notification message VM received from the time verification ECU 40 to the master ECU 10 and each of the slave ECUs 30.

[0141] [1-6. Example of operation during abnormality] The bridge ECU 20 normally receives the first synchronization message SY repeatedly at intervals within the allowable upper limit time. However, if the bridge ECU 20 fails to receive the first synchronization message SY for longer than the allowable upper limit time (i.e., if S320-YES is returned), the bridge ECU 20 assumes that an abnormality has occurred in the master ECU 10 and executes master substitute processing. The master substitute processing is processing in which the bridge ECU 20 transmits the first synchronization message SY and the second synchronization message FU instead of the master ECU 10. The allowable upper limit time may be changed based on control of the transmission timing of the master ECU 10.

[0142] In addition, if the bridge ECU 20 fails to receive the second synchronization message FU within the permissible waiting time after receiving the first synchronization message SY (i.e., in the case of S360-NO), the bridge ECU 20 determines that an abnormality has occurred in the master ECU 10 and performs master proxy processing.

[0143] By having the bridge ECU 20 execute the master substitute process, even if an abnormality occurs in the master ECU 10, it becomes possible to continue the process that requires time synchronization.

[0144] If the time verification ECU 40 fails to receive the master record notification message MM, then even if it receives the bridge record notification message BM and the slave record notification message SM, it is unable to perform time verification and therefore does not transmit a result notification message VM.

[0145] Furthermore, if each of the ECUs 10 to 30 that transmitted the record notification messages MM, BM, and SM does not receive the result notification message VM even after the allowable reply time has elapsed, it can recognize that some kind of abnormality has occurred and can deal with the abnormality.

[0146] Furthermore, each ECU 10 to 30 that receives the result notification message VM can check the state of time synchronization from the contents of the verification result indicated in the result notification message VM, and if there is an abnormality in the state of time synchronization, it can deal with the abnormality.

[0147] [1-7.Effects] According to the first embodiment described above in detail, the following effects are achieved.

[0148] (1a) In the time synchronization system 1, each of the ECUs 10 to 30 transmits its time record information to the time verification ECU 40. The time verification ECU 40 calculates verification information related to time synchronization based on the time record information received from the master ECU 10 and the time record information received from the bridge ECU 20 and each of the slave ECUs 30. The time verification ECU 40 transmits the calculated information related to time synchronization to each of the ECUs 10 to 30 by a result notification message VM. Each of the ECUs 10 to 30 can quickly determine the state of time synchronization by comparing the information indicated in the result notification message VM with the information related to time synchronization calculated by each of the ECUs 10 to 30.

[0149] [1-8. Correspondence of terms] In the first embodiment, the master ECU 10 corresponds to the master device in the present disclosure, the bridge ECU 20 and the multiple slave ECUs 30 correspond to the slave devices in the present disclosure, and the time verification ECU 40 corresponds to the time verification device in the present disclosure. The time record information recorded in the TMTR table and transmitted in the master record notification message MM corresponds to the master verification information in the present disclosure. The time record information recorded in the TSTR table and the STBR table and transmitted in the bridge record notification message BM and the slave record notification message SM corresponds to the slave verification information. The information recorded in the VD table and transmitted in the result notification message VM corresponds to the verification information. S120 and S150 correspond to the synchronization message transmission unit in the present disclosure, and S160 corresponds to the master information transmission unit in the present disclosure. S390 corresponds to the synchronization execution unit in the present disclosure, and S400 corresponds to the slave information transmission unit in the present disclosure. S530 corresponds to the verification execution unit in the present disclosure, and S550 corresponds to the result transmission unit in the present disclosure. S230 in FIG. 18 and S430 in FIGS. 10 and 11 correspond to the abnormality determination unit in this disclosure.

[0150] [2. Second embodiment] [2-1. Differences from the first embodiment] The second embodiment has a basic configuration similar to that of the first embodiment, and therefore differences will be described below. Note that the same reference numerals as those in the first embodiment indicate the same configuration, and the preceding description will be referred to.

[0151] In the above-described first embodiment, the master ECU 10 is configured to periodically transmit the first synchronization message SY to the bridge ECU 20. The second embodiment differs from the first embodiment in that the transmission timing is changed by changing the transmission interval of the first synchronization message SY based on the verification result of the time synchronization.

[0152] The second embodiment is similar to the first embodiment, except that the contents of the verification confirmation process executed in S170 of the master time process are partially different.

[0153] [2-2. Processing] The verification and confirmation process executed by the master ECU 10 of the second embodiment will be described with reference to the flowchart of Fig. 19. Note that the processes of S210 to S230 are similar to those of the first embodiment.

[0154] However, if the determination in S230 is affirmative, the master ECU 10 proceeds to S250. If the determination in S220 is affirmative or if the determination in S230 is negative, the master ECU 10 proceeds to S280.

[0155] In S250, the master ECU 10 determines whether the transmission interval of the first synchronization message SY is less than an upper limit value. If the transmission interval is less than the upper limit value, the master ECU 10 transitions to S260. If the transmission interval is equal to or greater than a predetermined value, the master ECU 10 terminates the verification confirmation process.

[0156] In S260, the master ECU 10 performs control to change the transmission interval of the first synchronization message SY. Specifically, the master ECU 10 changes the transmission interval of the first synchronization message SY to be longer than the current transmission interval.

[0157] In the next step S270, the master ECU 10 notifies the bridge ECU 20 that the transmission interval of the first synchronization message SY has been changed, and then ends the verification and confirmation process.

[0158] In S280, the master ECU 10 initializes the transmission interval of the first synchronization message SY. Specifically, the master ECU 10 sets the transmission interval to an initial value, which is the shortest value among the selectable transmission interval setting values.

[0159] In the next step S290, the master ECU 10 notifies the bridge ECU 20 that the transmission interval of the first synchronization message SY has been returned to the initial value, and ends the verification and confirmation process. Note that the processes of S280 and S290 are an example of the abnormality handling process shown in S240 of FIG.

[0160] In the previous step S260, the master ECU 10 may change the transmission interval of the first synchronization message SY, for example, by adding a predetermined value to the current value of the transmission interval each time S260 is executed. Also, in S260, the master ECU 10 may count the number of times the verification result is consecutively determined to be normal in the previous step S230 (hereinafter, the normal number), and change the transmission interval to a value previously associated with the normal number. Specifically, for example, the transmission interval of the first synchronization message SY may be changed when the normal number of times of the verification result becomes 5, 15, and 30. In this case, the transmission interval when the normal number of times of the verification result is 30 or more is set longer than the transmission interval when the normal number of times of the verification result is 15 to 29. Also, the transmission interval when the normal number of times of the verification result is 15 to 29 is set longer than the transmission interval when the normal number of times of the verification result is 5 to 14. The transmission interval when the verification result shows that the number of normal occurrences is 5 to 14 is set longer than the transmission interval when the verification result shows that the number of normal occurrences is 0 to 4 (i.e., the initial value). The number of normal occurrences that serves as the threshold for changing the transmission interval of the first synchronization message SY is not limited to the above 5, 15, and 30. Furthermore, the length of the transmission interval of the first synchronization message SY is not limited to the above four patterns. When the transmission interval of the first synchronization message SY is changed depending on the number of normal occurrences, the number of normal occurrences is also reset to 0 every time the transmission interval of the first synchronization message SY is initialized in S280.

[0161] [2-3. Effects] According to the second embodiment described above in detail, in addition to the effect (1a) of the first embodiment described above, the following effect is further achieved.

[0162] (2a) According to this embodiment, when an abnormality in the synchronization state is detected according to the result of the time verification, a process for dealing with the abnormality is executed promptly, and the longer the normal synchronization state continues, the longer the transmission interval of the first synchronization message SY is set. Therefore, an abnormality in the synchronization state (i.e., a time difference) can be dealt with promptly, and the frequency of executing the time synchronization verification is optimized according to the synchronization state, so that the processing load and communication load required for the time synchronization verification can be suppressed.

[0163] [2-4. Correspondence of terms] In the second embodiment, S230 corresponds to the synchronization state determination unit in this disclosure, and S250 to S260 correspond to the transmission interval control unit in this disclosure.

[0164] [3. Third embodiment] [3-1. Differences from the first embodiment] The second embodiment has a basic configuration similar to that of the first embodiment, and therefore differences will be described below. Note that the same reference numerals as those in the first embodiment indicate the same configuration, and the preceding description will be referred to.

[0165] In the first embodiment described above, the master ECU 10 is configured to transmit a master record notification message MM every time it transmits a first synchronization message SY and a second synchronization message FU to the bridge ECU 20. The third embodiment differs from the first embodiment in that the master record notification message MM is transmitted when a preset record transmission condition is satisfied.

[0166] The third embodiment is similar to the first embodiment, except for some differences in the content of the master time processing.

[0167] [3-2. Processing] The master time process executed by the master ECU 10 of the third embodiment will be described with reference to the flowchart of Fig. 20. Note that the process is the same as that of the first embodiment except that S125, S152, S154, S156, and S165 are added.

[0168] That is, after transmitting the first synchronization message SY in S120, the master ECU 10 increments the first counter C1, which counts the number of times the first synchronization message SY has been transmitted, by 1 in the subsequent S125, and proceeds to S130.

[0169] After transmitting the second synchronization message FU in S150, the master ECU 10 increments by one a second counter C2 that counts the number of times the second synchronization message FU has been transmitted in S152.

[0170] In the next step S154, the master ECU 10 executes a process of determining whether or not a record transmission condition is satisfied.

[0171] In the next step S156, the master ECU 10 determines whether or not the record transmission condition is determined to be satisfied as a result of the satisfaction determination process. If it is determined that the record transmission condition is satisfied, the process proceeds to S160. If it is determined that the record transmission condition is not satisfied, the master time process is terminated.

[0172] After transmitting the master record notification message MM in S160, the master ECU proceeds to S165, in which it increments a third counter C3, which counts the number of times the master record notification message MM has been transmitted, by 1, and proceeds to S170.

[0173] Next, the establishment determination process executed by the master ECU 10 in step S154 will be described with reference to the flowchart of FIG.

[0174] When the establishment determination process is started, the master ECU 10 determines in S610 whether the third counter C3 is less than the first threshold value TH1, and if it is less than the first threshold value TH1, transitions to S620, and if it is greater than or equal to the first threshold value TH1, transitions to S630.

[0175] In S620, the master ECU 10 determines whether the first counter C1 or the second counter C2 is equal to or greater than the second threshold value TH2, and if it is equal to or greater than the second threshold value TH2, the process proceeds to S640, and if it is less than the second threshold value TH2, the establishment determination process is terminated.

[0176] In S630, the master ECU 10 determines whether the first counter C1 or the second counter C2 is greater than or equal to the third threshold value TH3. If it is greater than or equal to the third threshold value TH3, the process proceeds to S640. If it is less than the third threshold value TH3, the establishment determination process ends.

[0177] In S640, the master ECU 10 determines that the record transmission condition is satisfied.

[0178] In the subsequent S650, the master ECU 10 initializes the first counter C1 and the second counter C2 to 0 and ends the establishment determination process.

[0179] That is, while the number of transmissions of the master record notification message MM is less than TH1 times, every time the master ECU 10 transmits the first synchronization message SY or the second synchronization message FU TH2 times, the master ECU 10 transmits the master record notification message MM once. After the number of transmissions of the master record notification message MM reaches TH1 times, every time the master ECU 10 transmits the first synchronization message SY or the second synchronization message FU TH3 times, the master ECU 10 transmits the master record notification message MM once.

[0180] For example, when TH2 < TH3, after the system is started, time verification is performed relatively frequently. After the number of transmissions of the master record notification message MM reaches TH1, time verification is performed relatively less frequently.

[0181] Here, the case where the establishment determination process is executed by the master ECU 10 has been described, but the establishment determination process may be similarly applied to the bridge ECU 20 and the slave ECU 30. In this case, however, the bridge ECU 20 is configured to change the transmission timing of the bridge record notification message BM according to the number of times the first synchronization message SY or the second synchronization message FU is transferred and the number of times the bridge record notification message BM is transmitted. Also, the slave ECU 30 is configured to change the transmission timing of the slave record notification message SM according to the number of times the first synchronization message SY or the second synchronization message FU is received and the number of times the slave record notification message SM is transmitted.

[0182] In the above-mentioned determination process, the transmission interval of the master record notification message MM is controlled in two stages by determining whether the third counter C3 is less than the first threshold value TH1 in S610, but the present invention is not limited to this. For example, the determination in S610 may be made in multiple stages, that is, the third counter C3 may be compared with multiple different threshold values, thereby controlling the transmission interval of the master record notification message MM in three or more stages.

[0183] [3-3. Effects] According to the third embodiment described above in detail, in addition to the effect (1a) of the first embodiment described above, the following effect is further achieved.

[0184] (3a) In this embodiment, when the record transmission condition is satisfied, a master record notification message MM is sent, thereby controlling the transmission interval of the master record notification message MM and, in turn, the frequency of executing the time verification process. Therefore, compared to the case where a master record notification message MM is sent every time a second synchronization message FU is sent, the processing load required for verifying time synchronization can be reduced.

[0185] (3b) In this embodiment, the record transmission conditions are controlled by the number of times the master record notification message MM is transmitted. Therefore, for example, after the system is started, the time verification process is executed relatively frequently until the operation stabilizes, and when the operation stabilizes, the frequency of the time verification process is reduced, thereby appropriately controlling the verification frequency of the time synchronization.

[0186] [3-4. Modifications] In the third embodiment, both the first counter C1 and the second counter C2 are provided, but it is also possible to provide only one of the first counter C1 and the second counter C2.

[0187] In the third embodiment, the master ECU 10 is configured to change the frequency of transmitting the master record notification message MM depending on the number of times the master record notification message MM is transmitted (i.e., the third counter C3). The master ECU 10 may always transmit the master record notification message MM every time it transmits the first synchronization message SY or the second synchronization message FU a number of times (for example, twice), regardless of the number of times the master record notification message MM is transmitted. In this case, the processes of S610 and S630 may be omitted in the establishment determination process shown in FIG. 21.

[0188] In the third embodiment, the system is configured to transmit a master record notification message MM when the record transmission condition is met. Conversely, the system may be configured to transmit a master record notification message MM at a certain verification timing under normal circumstances, and to stop transmitting the master record notification message MM when the record stop condition is met. In this case, for example, the effect of the transmission stop may be limited to the verification timing when the record stop condition is met, and the transmission of the master record notification message MM may be resumed at the next verification timing.

[0189] In the third embodiment, the master ECU 10 controls the timing of the verification of the time synchronization according to the number of times of transmission of the first synchronization message SY, the second synchronization message FU, and the master record notification message MM. The master ECU 10 may control the timing of the verification of the time synchronization by adding verification request information, which requests the verification of the time synchronization, to the first synchronization message SY or the second synchronization message FU. Specifically, when the master ECU 10 transmits the first synchronization message SY or the second synchronization message FU to which the verification request information is added, the master ECU 10 may determine that the record transmission condition is satisfied and transmit the master record notification message MM. In addition, the bridge ECU 20 and the slave ECU 30 may transmit the bridge record notification message BM and the slave record notification message SM when the bridge ECU 20 or the slave ECU 30 receives the first synchronization message SY or the second synchronization message FU to which the verification request information is added. Note that a 1-bit field (hereinafter, a time synchronization verification field) may be provided in the first synchronization message SY or the second synchronization message FU, and the verification of the time synchronization may be requested when the bit is "1". In addition, if the first synchronization message SY or the second synchronization message FU does not have a time synchronization verification field, or if the time synchronization verification field is "0", it may not be necessary to request that time synchronization verification be performed.

[0190] In the third embodiment, the master ECU 10 determines whether the record transmission condition is satisfied by comparing the number of times the first synchronization message SY or the second synchronization message FU is transmitted with the second threshold value TH2 or the third threshold value TH3. The master ECU 10 may determine that the record transmission condition is satisfied when the following specific conditions are satisfied:

[0191] <Specific conditions> - When the vehicle speed is detected to be above a specified value (e.g. 5km / h). When it is detected that an external device (such as a diagnostic tool or a repro tool) is connected to any of the ECUs 10 to 30. When a driving assistance ECU that performs driving assistance including autonomous driving as a slave ECU 30 detects that a driving assistance function or an autonomous driving function (such as adaptive cruise control and lane keep assist system) is turned on. When it is detected that specific data (for example, data including update data for vehicle functions or information indicating that time synchronization verification is to be performed) has been received.

[0192] The information related to the determination of the specific condition may be received directly by the master ECU 10 from a sensor or the like that collects information, or may be received indirectly by the master ECU 10 via the bridge ECU 20 from a slave ECU 30 that collects information from a sensor or the like. The information related to the determination of the specific condition may include, for example, vehicle speed, a connection state of an external device, an operating state of a driving assistance function or an automatic driving function, specific data, and the like.

[0193] By using such a specific condition, the frequency of verifying the time synchronization can be more appropriately controlled, and the processing load on each of the ECUs 10-40 and the communication load between each of the ECUs 10-40 can be reduced.

[0194] [3-5. Correspondence of terms] In the third embodiment, S154 corresponds to the establishment determination unit in this disclosure, and S610 to S620 correspond to the designated number of times changing unit in this disclosure. The record transmission condition corresponds to the verification information transmission condition in this disclosure, and the second threshold TH2 and the third threshold TH3 correspond to the designated number of times in this disclosure.

[0195] [4. Other embodiments] Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms.

[0196] (4a) In the above embodiment, the time verification ECU 40 is configured to return a result notification message VM regardless of the contents of the verification result, but may be configured not to send a result notification message VM if a time synchronization abnormality is detected from the verification result. In this case, the time verification process may be changed as shown in the flowchart of Fig. 13. The following describes the differences from the flowchart of Fig. 12.

[0197] That is, if the determination in S540 is positive, in S542 the time verification ECU 40 determines whether the time synchronization state is normal or not based on the verification result. If the time verification ECU 40 determines that the time synchronization state is normal, it shifts the process to S550, transmits a result notification message VM, and ends the process. If the time verification ECU 40 determines that there is an abnormality in the time synchronization state, it ends the process without transmitting the result notification message VM.

[0198] If the result notification message VM is not returned within the response allowable time after the transmission of the record notification message MM, BM, or SM, each of the ECUs 10 to 30 can determine that there is an abnormality in the time synchronization state and execute a process to deal with the abnormality. Note that S542 in FIG. 13 corresponds to the transmission prohibition unit in this disclosure.

[0199] (4b) In the above embodiment, the time verification ECU 40 sends the information recorded in the VR table as the verification result by using the result notification message VM. However, a request flag for requesting continuation or stop of time synchronization may be added. In this case, the time verification process may be changed as shown in the flowchart in FIG. 14. The following describes the differences from the flowchart in FIG. 12.

[0200] That is, if a positive judgment is made in S540, in S542, the time verification ECU 40 judges whether the time synchronization status is normal or not from the verification result, and if it is normal, the process proceeds to S544, and if there is an abnormality, the process proceeds to S546.

[0201] In S544, the time verification ECU 40 adds a request flag indicating continuation of the time synchronization to the result notification message VM, and proceeds to S550.

[0202] In S546, the time verification ECU 40 adds a request flag indicating the stop of time synchronization to the result notification message VM, and advances the process to S550.

[0203] Each of the ECUs 10 to 30 continues or stops the time synchronization according to the request flag added to the result notification message VM. Note that steps S542 to S546 in FIG. 14 correspond to an information adding unit in the present disclosure.

[0204] (4c) In the above embodiment, the result notification messages VM including the verification results of the ECUs 20 to 30 are simultaneously transmitted by broadcast, but they may be transmitted individually to the ECUs 10 to 30. When transmitting the result notification messages VM individually, only the verification results related to the destination ECU may be transmitted.

[0205] (4d) In the above embodiment, the external device interface 50 for connecting the external diagnostic tool 60 is connected to the bridge ECU 20, but the external device interface 50 may be connected to the master ECU 10 or the time verification ECU 40. In addition, the external diagnostic tool 60 may be configured to be connected to any one of the master ECU 10, the bridge ECU 20, or the time verification ECU 40 via a wireless communication IF.

[0206] (4e) In the above-described embodiment, the time verification ECU 40 is configured as an independent ECU. However, the function of the time verification ECU 40 may be provided in the bridge ECU 20a as shown in FIG. 15, or in the master ECU 10a as shown in FIG. 16.

[0207] (4f) In the above embodiment, the reception timing of the second synchronization message FU is used as the reference point for adjusting the synchronous local time to the global time, but the reference point may be set arbitrarily.

[0208] (4g) Each of the ECUs 10 to 40 and the method thereof described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, each of the ECUs 10 to 40 and the method thereof described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, each of the ECUs 10 to 40 and the method thereof described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transient tangible recording medium as instructions executed by a computer. The method for realizing the functions of each unit included in each of the ECUs 10 to 40 does not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0209] (4h) Multiple functions possessed by one component in the above embodiments may be realized by multiple components, or one function possessed by one component may be realized by multiple components. Also, multiple functions possessed by multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0210] (4i) In addition to the above-mentioned time synchronization system 1 and time verification device 40, the present disclosure can also be realized in various forms, such as a program for causing a computer to function as the time verification device 40, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a time verification method.

[0211] [5. Technical Concepts Disclosed in This Specification] [Item 1] The system comprises a master device (10), one or more slave devices (20, 30), and a time verification device (40) connected via a communication network, The master device a synchronization message transmission unit (S120, S150) configured to repeatedly transmit to each of the one or more slave devices a synchronization message including a transmission time indicated in a global time counted by a clock of the master device; a master information transmission unit (S160) configured to transmit master verification information including a transmission time of the synchronization message to the time verification device; Equipped with The slave device is a synchronization execution unit (S390) configured to perform time synchronization to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by the global time based on information obtained by receiving the synchronization message; a slave information transmission unit (S400) configured to transmit slave verification information including information used for time synchronization by the synchronization execution unit to the time verification device; Equipped with The time verification device includes: generating verification information for verifying a synchronization state between the local time and the global time for each of the slave devices based on the master verification information received from the master device and the slave verification information received from each of the one or more slave devices; A verification execution unit (S530) configured as described above; a result transmission unit (S550) configured to transmit the verification information generated by the verification execution unit to each of the one or more slave devices; A time synchronization system comprising:

[0212] [Item 2] The time synchronization system according to item 1, The time verification device includes: a transmission prohibition unit (S542) configured to prohibit the result transmission unit from transmitting the verification information when an abnormality in the synchronization state is detected based on the verification information; The master device and the slave device The apparatus further includes an abnormality determination unit (S220, S420) configured to determine that an abnormality exists in the synchronization state when verification information is not received within a permissible time after the master verification information or the slave verification information is transmitted. Time synchronization system.

[0213] [Item 3] The time synchronization system according to item 1, The time verification device further includes an information adding unit (S542 to S546) that determines whether or not the time synchronization state is normal based on the verification information and adds additional information indicating a result of the determination to the verification information; The master device and the slave device are configured to continue or stop the time synchronization according to the additional information. Time synchronization system.

[0214] [Item 4] A time synchronization system according to any one of items 1 to 3, The time verification device further includes an external device interface (50) to which an external diagnostic tool (60) for reading the verification result of the time verification device is detachably attached. Time synchronization system.

[0215] [Item 5] A time synchronization system according to any one of items 1 to 4, the one or more slave devices being a plurality of slave devices; One of the plurality of slave devices is a bridge device, The slave devices other than the bridge device and the master device are connected to each other via the bridge device. Time synchronization system.

[0216] [Item 6] Item 5. A time synchronization system according to item 5, The time verification device is configured integrally with either the master device or the bridge device. Time synchronization system.

[0217] [Item 7] A time synchronization system according to any one of items 1 to 6, The verification execution unit calculates, as the verification information, at least one of a time offset representing a difference between a reference global time, which is a time at a reference point where time adjustment is performed and a reference local time, which is represented in the global time, and a time deviation, which is a difference between a value representing a time length between the reference points and a value representing the local time. Time synchronization system.

[0218] [Item 8] A time synchronization system according to any one of items 1 to 7, The master device a synchronization state determination unit (S230) configured to determine whether the synchronization state is normal or not according to the verification information received from the time verification device; a transmission interval control unit (S250 to S260) configured to change the transmission interval of the synchronization message by the synchronization message transmission unit according to the number of times the synchronization state is normal according to the result of the judgment by the synchronization state judgment unit; Further comprising Time synchronization system.

[0219] [Item 9] Item 8. A time synchronization system according to item 8, The transmission interval control unit is configured to change the transmission interval of the synchronization message by the synchronization message transmission unit so that the longer the synchronization state continues to be normal, the longer the transmission interval becomes according to the determination result by the synchronization state determination unit. Time synchronization system.

[0220] [Item 10] A time synchronization system according to any one of items 1 to 9, the master information transmission unit is configured to transmit the master verification information each time the synchronization message is transmitted one or more times; Time synchronization system.

[0221] [Item 11] A time synchronization system according to any one of items 1 to 9, the master information transmission unit is configured to transmit the master verification information when the synchronization message includes information requesting verification of time synchronization; Time synchronization system.

[0222] [Item 12] A time synchronization system according to any one of items 1 to 11, The master device a verification information transmission condition determination unit (S154) configured to determine whether a predetermined verification information transmission condition is satisfied; The master information transmission unit is configured to transmit the master verification information when the validation determination unit determines that the validation information transmission condition is satisfied. Time synchronization system.

[0223] [Item 13] Item 13. The time synchronization system according to item 12, The establishment determination unit is configured to determine that the verification information transmission condition is established every time the synchronization message is transmitted a specified number of times. Time synchronization system.

[0224] [Item 14] Item 14. A time synchronization system according to item 13, The master device The method further includes a designated number of times change unit (S610 to S620) configured to change the designated number of times so that the designated number of times increases as the number of times the master verification information is transmitted increases. Time synchronization system.

[0225] [Item 15] A time synchronization system according to any one of items 12 to 14, The establishment determination unit is configured to determine whether or not the verification information transmission condition is established using at least one of the following: a vehicle speed is equal to or greater than a predetermined value; an external device is connected to the time synchronization system; a function related to driving assistance including autonomous driving is in an active state; and information requesting verification of the synchronization state is added to the synchronization message. Time synchronization system.

[0226] [Item 16] A time verification device, comprising: A time synchronization system including a master device (10) and one or more slave devices (20, 30) connected via a communication network, the time synchronization system being configured to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by a global time counted by a clock of the master device, a verification execution unit (S530) configured to generate, for each of the slave devices, verification information for verifying a synchronization state between the local time and the global time, based on master verification information received from the master device and slave verification information received from each of the one or more slave devices; a result transmission unit (S550) configured to transmit the verification information generated by the verification execution unit to each of the one or more slave devices; Equipped with the master verification information includes a transmission time of a synchronization message indicated in the global time; The slave verification information is obtained by receiving the synchronization message and includes information used for the time synchronization. Time verification device.

[0227] [Item 17] A time verification method in a time synchronization system including a master device (10), one or more slave devices (20, 30), and a time verification device (40) connected via a communication network, comprising: The master device Repeatedly transmitting a synchronization message including a transmission time indicated in global time counted by a clock of the master device to each of the one or more slave devices (S120, S150); Transmitting master verification information including a transmission time of the synchronization message to the time verification device (S160); The slave device is performing time synchronization to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by the global time based on information obtained by receiving the synchronization message (S390); Transmitting slave verification information including information used for the time synchronization to the time verification device (S400); The time verification device includes: generating, for each of the slave devices, verification information for verifying a synchronization state between the local time and the global time based on the master verification information received from the master device and the slave verification information received from each of the one or more slave devices (S530); Transmitting the generated verification information to each of the one or more slave devices (S550); Time verification method.

Claims

1. The system comprises a master device (10), one or more slave devices (20, 30), and a time verification device (40) connected via a communication network, The master device a synchronization message transmission unit (S120, S150) configured to repeatedly transmit to each of the one or more slave devices a synchronization message including a transmission time indicated in a global time counted by a clock of the master device; a master information transmission unit (S160) configured to transmit master verification information including a transmission time of the synchronization message to the time verification device; Equipped with The slave device is a synchronization execution unit (S390) configured to perform time synchronization to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by the global time based on information obtained by receiving the synchronization message; a slave information transmission unit (S400) configured to transmit slave verification information including information used for time synchronization by the synchronization execution unit to the time verification device; Equipped with The time verification device includes: a verification execution unit (S530) configured to generate, for each of the slave devices, verification information for verifying a synchronization state between the local time and the global time, based on the master verification information received from the master device and the slave verification information received from each of the one or more slave devices; a result transmission unit (S550) configured to transmit the verification information generated by the verification execution unit to each of the master device and the one or more slave devices; A time synchronization system comprising:

2. 2. The time synchronization system according to claim 1, The time verification device includes: a transmission prohibition unit (S542) configured to prohibit the result transmission unit from transmitting the verification information when an abnormality in the synchronization state is detected based on the verification information; The master device and the slave device The apparatus further includes an abnormality determination unit (S220, S420) configured to determine that an abnormality exists in the synchronization state when the verification information is not received within an allowable time after the master verification information or the slave verification information is transmitted. Time synchronization system.

3. 2. The time synchronization system according to claim 1, The time verification device further includes an information adding unit (S542 to S546) that determines whether or not the time synchronization state is normal based on the verification information and adds additional information indicating a result of the determination to the verification information; The master device and the slave device are configured to continue or stop the time synchronization according to the additional information. Time synchronization system.

4. A time synchronization system according to any one of claims 1 to 3, The time verification device further includes an external device interface (50) to which an external diagnostic tool (60) for reading the verification result of the time verification device is detachably attached. Time synchronization system.

5. A time synchronization system according to any one of claims 1 to 3, the one or more slave devices are a plurality of slave devices; One of the plurality of slave devices is a bridge device, The slave devices other than the bridge device and the master device are connected to each other via the bridge device. Time synchronization system.

6. The time synchronization system according to claim 5 , The time verification device is configured integrally with either the master device or the bridge device. Time synchronization system.

7. A time synchronization system according to any one of claims 1 to 3, The verification execution unit calculates, as the verification information, at least one of a time offset representing a difference between a reference global time, which is a time at a reference point where time adjustment is performed and a reference local time, which is represented in the global time, and a time deviation, which is a difference between a value representing a time length between the reference points and a value representing the local time. Time synchronization system.

8. 2. The time synchronization system according to claim 1, The master device a synchronization state determination unit (S230) configured to determine whether the synchronization state is normal or not according to the verification information received from the time verification device; a transmission interval control unit (S250 to S260) configured to change the transmission interval of the synchronization message by the synchronization message transmission unit according to the number of times the synchronization state is normal according to the judgment result by the synchronization state judgment unit; Further comprising Time synchronization system.

9. 2. The time synchronization system according to claim 1, the master information transmission unit is configured to transmit the master verification information each time the synchronization message is transmitted one or more times; Time synchronization system.

10. 2. The time synchronization system according to claim 1, The master device a verification information transmission condition determination unit (S154) configured to determine whether a predetermined verification information transmission condition is satisfied; The master information transmission unit is configured to transmit the master verification information when the validation determination unit determines that the validation information transmission condition is satisfied. Time synchronization system.

11. The time synchronization system according to claim 10, The establishment determination unit is configured to determine that the verification information transmission condition is established every time the synchronization message is transmitted a specified number of times. Time synchronization system.

12. The time synchronization system according to claim 11, The master device The method further includes a designated number of times change unit (S610 to S620) configured to change the designated number of times so that the designated number of times increases as the number of times the master verification information is transmitted increases. Time synchronization system.

13. The time synchronization system according to claim 10, The establishment determination unit is configured to determine whether or not the verification information transmission condition is established using at least one of the following: a vehicle speed is equal to or greater than a predetermined value; an external device is connected to the time synchronization system; a function related to driving assistance including autonomous driving is in an active state; and information requesting verification of the synchronization state is added to the synchronization message. Time synchronization system.

14. A time verification device, comprising: A time synchronization system including a master device (10) and one or more slave devices (20, 30) connected via a communication network, the time synchronization system being configured to synchronize a time indicated by a local time counted by a clock of the slave device with a time indicated by a global time counted by a clock of the master device, a verification execution unit (S530) configured to generate, for each of the slave devices, verification information for verifying a synchronization state between the local time and the global time, based on master verification information received from the master device and slave verification information received from each of the one or more slave devices; a result transmission unit (S550) configured to transmit the verification information generated by the verification execution unit to each of the one or more slave devices; Equipped with the master verification information includes a transmission time of a synchronization message indicated in the global time; The slave verification information is obtained by receiving the synchronization message and includes information used for the time synchronization. Time verification device.

15. A time verification method in a time synchronization system including a master device (10), one or more slave devices (20, 30), and a time verification device (40) connected via a communication network, comprising: The master device Repeatedly transmitting a synchronization message including a transmission time indicated in global time counted by a clock of the master device to each of the one or more slave devices (S120, S150); Transmitting master verification information including the transmission time of the synchronization message to the time verification device (S160); The slave device is Based on information obtained by receiving the synchronization message, time synchronization is performed to synchronize the time indicated by the local time counted by the clock of the slave device with the time indicated by the global time (S390); Slave verification information including information used for the time synchronization is transmitted to the time verification device (S400); The time verification device includes: generating, for each of the slave devices, verification information for verifying a synchronization state between the local time and the global time based on the master verification information received from the master device and the slave verification information received from each of the one or more slave devices (S530); Transmitting the generated verification information to each of the one or more slave devices (S550); Time verification method.

Images