Verify time synchronization

Abstract

This provides a technology for verifying time synchronization among multiple controllers connected via a private bus. A method for verifying time synchronization of at least two controllers connected to each other via a private bus, one of the at least two controllers being a master controller and the other being a slave controller, is provided, the method comprising a number of cycles, each cycle comprising: sending a follow-up message from the master controller to the slave controller in response to the pulling of a predefined pin on the master controller, wherein the follow-up message includes the master controller's global time when the pull of the predefined pin was made; sending a validation message from the slave controller to the master controller in response to the received follow-up message, wherein the validation message includes the slave controller's global time when the pull of the predefined pin was detected by the slave controller; The global time of the master controller when a predefined pin is pulled; The global time of the slave controller when a pull on a predefined pin is detected by the slave controller. verifying time synchronization in the master controller and / or the slave controller by checking whether the difference between Equipped with.

Description

[Technical field]

[0001] The present invention relates to a method for verifying time synchronization of at least two controllers connected to each other via a private bus, a master controller connected to a slave controller via a private bus and configured to at least partially perform the aforementioned verification method, a slave controller connected to the master controller via a private bus and configured to at least partially perform the aforementioned verification method, a communication network comprising the aforementioned master controller and slave controllers, and a vehicle, e.g. an automobile, comprising the aforementioned communication network. [Background technology]

[0002] As autonomous and automated vehicles become more complex, multiple communication buses are used by the various electronic control units (ECUs) to ensure that the autonomous or automated functions meet safety requirements, e.g. those necessary to meet the so-called Automotive Safety Integrity Level (ASIL).

[0003] Automotive Safety Integrity Level (ASIL) is a risk classification scheme defined by ISO 26262 "Functional Safety of Road Vehicles". The ASIL classification consists of five safety levels, ranging from QM, which has the lowest safety requirements, to ASIL D, which has the highest safety requirements.

[0004] All relevant controllers involved in critical decision making for autonomous driving functions must have their time synchronized according to the other controllers. Time synchronization for highly automated vehicles, e.g. SAE Level 3 or Level 4 vehicles and above (SAE J3016 standard describes the classification and definition of terms for road vehicles equipped with autonomous driving systems), must meet ASIL D.

[0005] In the state of the art, time synchronization on Ethernet buses is performed according to IEEE 802.IAS for TSN (Time Sensitive Networks) and IEEE 1588 for PTP (Precision Time Protocol). However, for time synchronization via PTP there are a number of measures that can be adopted on top of the respective standards to ensure the integrity of the synchronization process and therefore of the distributed time bases. Summary of the Invention [Problem to be solved by the invention]

[0006] However, the PTP implementation of time synchronization cannot be used if the controllers are connected to each other by private bus systems (e.g. PCI Express, CAN-FD, MIPI, SERDES, SPI, etc.). In light of this state of the art, the problem of the present invention is to provide a solution for the verification of the time synchronization of at least two controllers connected to each other via a private bus, where it is ensured that a predefined safety integrity level (e.g. ASIL B or higher) is met. [Means for solving the problem]

[0007] This problem is solved by the features of the independent claim(s). The dependent claims contain preferred further developments of the invention.

[0008] More specifically, the above object is solved by a method for verifying time synchronization of at least two controllers connected to each other via a private bus, where one of the at least two controllers is a master controller and the other one is a slave controller.

[0009] The method comprises a number of cycles, each cycle including sending a follow-up message from the master controller to a slave controller in response to a pull of a predefined pin of the master controller, where the follow-up message includes a global time of the master controller when the pull of the predefined pin was made.

[0010] Each cycle further comprises sending a validation message from the slave controller to the master controller in response to the received follow-up message, where the validation message includes the slave controller's global time when a pull of the predefined pin was detected by the slave controller.

[0011] Each cycle (except the first or first cycle) further comprises a verification of the time synchronization in the master controller and / or in the slave controller by checking whether the difference between the global time of the master controller when the predefined pin pull is made and the global time of the slave controller when the predefined pin pull is detected by the slave controller is smaller than a first predefined threshold value, a prerequisite for this execution being that the synchronized global time in the master controller has already been verified.

[0012] The method may include capturing a global time of the master controller when a pull of a predefined pin was made at the master controller, and the validation message may include a local hardware counter of the slave controller, where the local hardware counter corresponds to the global time of the slave controller when the pull of the predefined pin was detected by the slave controller.

[0013] The slave controller's local hardware counter is a second source of time that enables the master and / or slave controller to perform the next check.

[0014] That is, the verification of the time synchronization may further comprise checking, at the master controller, whether: the difference between the global time captured by the master controller when the predefined pin pull is made and the global time captured by the master controller when the predefined pin pull is made in the previous cycle; the difference between the local hardware counter representing the global time of the slave controller when the predefined pin is pulled and the local hardware counter representing the global time of the slave controller as seen by the slave controller in the previous cycle; is less than a second predefined threshold. This verification is not performed at the beginning, i.e. in the first cycle, of the method.

[0015] Additionally or alternatively, the verification of time synchronization may comprise checking at the slave controller: the difference between the global time of the master controller received by the slave controller in the follow-up message and the global time of the master controller received by the slave controller in the follow-up message in the previous cycle; a difference between a local hardware counter corresponding to the global time of the slave controller when a pull on the predefined pin is detected by the slave controller and a local hardware counter corresponding to the global time of the slave controller when a pull on the predefined pin is detected by the slave controller in the previous cycle; is less than a second predefined threshold value.

[0016] The validation message may contain the difference between a local hardware counter corresponding to the slave controller's global time when the pull of the predefined pin is detected by the slave controller and a local hardware counter corresponding to the slave controller's global time when the pull of the predefined pin is detected by the slave controller in the previous cycle. That is, the validation message already contains the difference between the hardware counters, which is calculated by the slave controller. The master controller may be connected to a further (separate) bus. This further bus may be called the main bus.

[0017] The master controller may have a master port and a slave port via which it is connected to a further bus. The slave port and the master port may each have their own clock.

[0018] This method is Synchronizing the clocks of the slave ports of the master controller with the global time of the further bus; Preferably after synchronizing the global time of the clock of the slave port with the global time of the further bus, synchronizing the global time of the clock of the master port of the master controller with the global time of the clock of the slave port of the master controller; may be provided.

[0019] The method may further comprise capturing, at the master controller, the global time of the slave port when the pull of the predefined pin is made, preferably also after synchronizing the global time of the slave port's clock to the global time of the further bus.

[0020] From the above, the master controller can perform the following checks: Verification of time synchronization may comprise the following checks at the master controller: the global time captured by the master controller at its master port, i.e. the global time of the clock at the master controller's master port when the predefined pin pull is made; The global time captured by the master controller on its slave port, i.e. the global time of the clock on the master controller's slave port when the predefined pin pull is made. is less than a predefined third threshold value.

[0021] The method may preferably comprise capturing a local hardware counter and a global time of the slave controller when a pull of the predefined pin is detected by the slave controller, and then updating the global time of the slave controller to the global time of the master controller included in the follow-up message.

[0022] The verification message may include the global time sent in a follow-up message from the master controller to the slave controller. Thus, the verification of time synchronization includes: the global time captured by the master controller when a predefined pin pull is made; The global time included in the validation message and is less than a fourth predefined threshold value.

[0023] Additionally, a master controller is provided, where the master controller is configured to be connected to the slave controller via a private bus.

[0024] The master controller is further configured to send a follow-up message to the slave controller over the private bus in response to the master controller pulling the predefined pin and record or capture the time the pin pull occurred, where the follow-up message includes the master controller's global time when the predefined pin pull occurred.

[0025] The master controller is configured to receive a validation message from said slave controller over the private bus in response to the sent follow-up message, where the validation message includes a global time of the slave controller when a pull of the predefined pin is detected by the slave controller.

[0026] The master controller is further configured to verify time synchronization of the global time of the slave controllers with the global time of the master controller by checking: The global time of the master controller when a predefined pin pull is made; The global time of the slave controller when a pull on a predefined pin is detected by the slave controller. is less than a predefined first threshold value.

[0027] The validation message may comprise a local hardware counter of the slave controller as a second source of time, where the local hardware counter corresponds to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller.

[0028] The master controller can be configured to capture the master controller's global time when a predefined pin pull is made, i.e., the master controller may include at least one clock, the time of which is captured by the master controller when a predefined pin pull is made.

[0029] The master controller can be configured to verify the time synchronization of the slave controllers' global time with the master controller's global time by the following checks: the difference between the global time captured by the master controller when the predefined pin pull is made and the global time captured by the master controller when the predefined pin pull is made in the previous cycle; the difference between a local hardware counter corresponding to the global time of the slave controller when a pull on the predefined pin is detected by the slave controller and a local hardware counter corresponding to the global time of the slave controller when a pull on the predefined pin is detected by the slave controller in the previous cycle; is less than a predefined second threshold.

[0030] The validation message may comprise the difference between a local hardware counter corresponding to the global time of the slave controller when a pull of the predefined pin was detected by the slave controller and a local hardware counter corresponding to the global time of the slave controller when a pull of the predefined pin was detected by the slave controller in the previous cycle.

[0031] The master controller may be configured to connect to further buses and to synchronize the global time of the master controller to the global time of the further buses.

[0032] More specifically, the master controller may comprise a master port and a slave port, where each of the slave port and the master port comprises a clock. The master controller may connect via its slave port to a further bus, for example the main bus of the vehicle. The master controller may then be configured to synchronize the global time of the slave port's clock to the global time of the further bus. This can be done using PTP. Preferably, the master controller then synchronizes the global time of the master port's clock to the global time of the master controller's slave port's clock, capturing the global time of the slave port when the predefined pin pull is made.

[0033] The master controller can be configured to verify the time synchronization of the global time of the slave port's clock and the global time of the master port's clock by the following checks: The global time of the master port's clock (preferably captured when a predefined pin pull is made); and The global time of the slave port's clock (also preferably captured when a predefined pin pull is made) is less than a predefined third threshold value.

[0034] This verification allows the master controller to check whether the difference between the internal clocks is within a certain tolerance.

[0035] Further provided is a slave controller, where the slave controller is configured to be connected to the master controller via a private bus, and where the slave controller is configured to receive a follow-up message from the master controller via the private bus in response to a pull of a predefined pin of the master controller, where the follow-up message includes a global time of the master controller when the pull of the predefined pin was made.

[0036] The slave controller is further configured to detect a pull of a predefined pin of the master controller and capture a global time of the slave controller when a pull of the predefined pin is detected by the slave controller.

[0037] The slave controller is further configured to verify by checking the time synchronization by checking: The global time of the master controller included in the follow-up message, the global time captured by the slave controller when the pull of the predefined pin is detected by the slave controller, i.e., the global time of the slave controller's clock when the pull of the predefined pin is detected by the slave controller; is less than a predefined first threshold value.

[0038] The slave controller can be configured to send a validation message to the master controller via the private bus in response to a received follow-up message.

[0039] The verification message may include the global time of the slave controller when the pull of the predefined pin is detected by the slave controller, allowing the master controller to verify the time synchronization with the master controller by the following checks: The global time of the master controller when a predefined pin pull is made; The global time of the slave controller when a pull on a predefined pin is detected by the slave controller. is less than a predefined first threshold. The verification message may also include the global time of the master controller, which is included in the follow-up message.

[0040] A slave controller may be configured to capture a local hardware counter of the slave controller, where the local hardware counter corresponds to the global time of the slave controller when a pull on a predefined pin is detected by the slave controller.

[0041] A slave controller may be configured to verify time synchronization between the slave controller's global time and the master controller's global time by the following check: the difference between the global time of the master controller included in the follow-up message and the global time of the master controller included in the follow-up message in a previous cycle; the difference between a local hardware counter corresponding to the global time of the slave controller when a pull on the predefined pin is detected by the slave controller and a local hardware counter corresponding to the global time of the slave controller when a pull on the predefined pin is detected by the slave controller within a previous cycle; is less than a second predefined threshold value.

[0042] A slave controller can be configured to send a verification message that includes the slave controller's local hardware counter and the master controller's global time included in a follow-up message, allowing the master controller to verify the time synchronization of the slave controller's global time with the master controller's global time by checking: the difference between the global time of the master controller included in the validation message and the global time of the master controller included in the validation message in the previous cycle; the difference between the local hardware counter that corresponds to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller and the local hardware counter that corresponds to the global time of the slave controller when the pull of the predefined pin is detected by the slave controller in the previous cycle; The verification message may include both local hardware counters, or it may include only the difference between the two local hardware counters.

[0043] The slave controller can be configured to capture a local hardware counter and the slave controller's global time, and then update the slave controller's global time to the master controller's global time included in a follow-up message when a pull of a predefined pin is detected by the slave controller.

[0044] Further provided is a communication network, wherein the communication network may comprise a master controller as described above, a slave controller as described above, and a private communication bus interconnecting the master controller and the slave controller. The private communication bus may consist of connections between predefined pins of the master controller and the slave controller. The communication network may comprise a further communication bus connected to the master controller. Wherein the master controller is configured to synchronize its global time to a global time of the further bus.

[0045] Furthermore, a vehicle, for example a car, can be provided, which is equipped with the above-mentioned communication network.

[0046] In short, the basic principle of the present invention is to emulate PTP for controller time synchronization.

[0047] Validation of the time synchronization according to ASIL B or ASIL D can be ensured by various safety mechanisms. A controller, for example a microcontroller, may be divided into a master controller with one or more slave controllers. Here, the master controller is connected to any communication bus that allows standard time synchronization (for example Ethernet, FlexRay, CAN-FD). Only the master controller is connected to an additional bus, the main bus, so that the master controller and the slave controllers are part of a private network, i.e. a self-contained network.

[0048] A master controller may have only one time representation, or may have a time-synchronized slave port and multiple time-synchronized master ports.

[0049] The master controller provides a follow-up message containing the global time when a predefined pin, for example a general purpose input / output pin (GPIO), is pulled from the master controller. A slave controller may only have a time-synchronized slave port.

[0050] A combination of pin pulling, or emulated pin pulling, can be used to provide emulated pin pulling together with a time synchronization mechanism with follow-up messages.

[0051] As close as possible to the time that a pull on a predefined pin on the master controller is detected on the slave controller side, the value of a local hardware counter and its associated global time can be captured.

[0052] The global time at the slave controller needs to be captured before it can be updated based on the new value received by a follow-up message, i.e. a follow-up message sent from the master (controller) to the slave controller in response to the pulling of a predefined pin.

[0053] After capturing the hardware counter and global time at the slave controller, the time synchronization mechanism can update the global time at the slave controller using a follow-up message.

[0054] The time synchronization mechanism, i.e., a GPIO pull and follow-up message and a local hardware counter, can be used to verify the system time on the slave controller.

[0055] This concept allows different controllers, which may be interconnected by communication channels, where standard synchronization and validation mechanisms are not available, to internally validate their time.

[0056] For time verification, a single pin connection for commonly used time synchronization can be shared between time synchronization and time verification on the master and slave controllers, respectively, eliminating the need for additional pin (e.g., GPIO) connections between the master and slave controllers.

[0057] During the period between any two synchronizations, a validation message can be sent from the slave controller to the master controller, ie a validation message in response to a received follow-up message.

[0058] This validation message includes the difference in the slave controller's hardware counter between the two synchronization points, the slave controller's global time captured when a pull on a predefined pin was registered in the current communication cycle, plus the global time received in a follow-up message.

[0059] The master controller can capture a global time that is written into the follow-up message very close to the time that the predefined pin pull is made.

[0060] Safety or validation checks can be performed on the master and slave controllers to include LEAP detection on both the master and slave controllers: on the slave side, the difference between the global time captured on the slave controller at the time a predefined pin pull is made and the global time received in the follow-up message must be less than a predefined first threshold.

[0061] On the master side, the difference between the global time written in the follow-up message and the global time received on the slave side contained in the validation message must be smaller than a predefined first threshold value.

[0062] In the following, one embodiment of the present invention will be described with reference to FIGS. [Brief description of the drawings]

[0063] [Figure 1] FIG. 1 shows a schematic diagram of a communication network used in a method for verifying time synchronization of at least two controllers interconnected via a private bus. [Diagram 2] FIG. 2 illustrates diagrammatically a flow chart of a method for verifying the time synchronization of at least two controllers connected to each other via a private bus. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0064] To summarize from FIG. 1, the communication network 1 comprises a master controller 2, a slave controller 3, and a private communication bus 4 interconnecting the master controller 2 and the slave controller 3.

[0065] The master controller 2 comprises a slave port 21 which is connected to a master port 51 of a master controller 5 of another, i.e. further, communication network. The master controller 2 further comprises a master port 22 which is connected to a slave port 31 of a slave controller 3 via a private communication bus 4. Here, these ports 22, 31 are used for time synchronization of the master controller 2 and the slave controller 3, as will be described in more detail below with respect to FIG.

[0066] The further communication network, i.e. the further communication bus (e.g. Ethernet, FlexRay, CAN-FD) allows for standard time synchronization, a process in which the global time of the master controller 2 is synchronized to the global time of the further communication bus, for example by receiving in the master controller 2 via the slave port 21 a time synchronization message with a synchronization time TASI from the master controller 51 of the further communication network.

[0067] More specifically, each master port 22 and slave port 21 is equipped with its own clock. The global time of the slave port 21 clock is synchronized to the global time of a further bus, for example using PTP, and then the global time of the master port 22 clock is synchronized to the synchronized global time of the slave port 21 clock.

[0068] The aforementioned method comprises multiple cycles, here two of which are shown in Fig. 2. The start of each cycle is initiated by a pull of a predefined pin of the master controller 2, here a pull of the cyclic GPIO.

[0069] First, i.e. after synchronizing the global time of the master controller 2 with the global time of the further bus, the master controller 2 sends a follow-up message to the slave port 31 of the slave controller 3 in response to a pull of a predefined pin of the master controller 2 via the private communication bus 4.

[0070] The follow-up message is sent at the global time t aM1 , t aM2 , i.e. with predefined pin pulled times during the actual cycle of the method.

[0071] In response to the follow-up message received by the slave controller 3 , the slave controller 3 sends a verification message to the master controller 2 via its slave port 31 and the communication bus 4 .

[0072] The validation message includes the global time t of the slave controller 3 when a pull of a predefined pin is detected by the slave controller 3 in the actual or current cycle. bs1 , t bs2 The master controller 3 receives the global time t bs1 , t bs2The verification message includes the local hardware counter C of the slave controller 3. bs1 , C bs2 It also contains a local hardware counter C bs1 , C bs2 is the global time t of the slave controller 3 when a pull on a predefined pin is detected by the slave controller 3 in the current cycle. bs1 , t bs2 is equivalent to.

[0073] Therefore, the slave controller 3 will start the local hardware counter C when a pull on the predefined pin is detected by the slave controller 3. bs1 , C bs2 Together with the global time t of slave controller 3 bs1 , t bs2 As can be summarized from Figure 2, the hardware counter C bs1 , C bs2 Each value of is the global time t bs1 , t bs2 , i.e. directly linked to the synchronous time.

[0074] The slave controller 3 determines the global time t of the slave controller 3 when a pull of a predefined pin is detected by the slave controller 3 in the current cycle. bs2 The local hardware counter C bs2 and the global time t of the slave controller when the pull of the predefined pin was detected by the previous slave controller 3. bs1 The local hardware counter C bs1 This difference is sent in a verification message from the slave controller 3 to the master controller 2. bs1 , C bs1is the value captured in the previous synchronization cycle. Since this difference cannot be calculated in the first cycle of the method (because there is no local hardware counter equivalent to the slave controller's global time when the pull of the predefined pin was detected by the slave controller 3 in the previous cycle), this value is set to zero during the first cycle, i.e., in the first validation message.

[0075] These values ​​t bs1 , C bs1 , t bs2 , C bs2 After capturing, the slave controller 3 updates, i.e., changes its global time to global time t' aM1 , t' aM2 synchronizes with the follow-up message received from Master Controller 2.

[0076] Furthermore, the slave controller 3 includes the global time t' in the verification message received from the master controller 2 in the follow-up message. aM1 , t' aM2 The global time is the time when the global time of the slave controller 3 was updated. The global time t' received from the follow-up message is added to the global time. aM1 , t' aM2 Sending the value back to the master controller 2 ensures that the value has not been tampered with along the communication path (e.g., at at least one of the following points during transmission on the private bus 4: at the sending communication stack of the master controller 2, at the receiving communication stack of the slave controller 3, at the sending communication stack of the slave controller 3, and at the receiving communication stack of the master controller 2).

[0077] Since software processing in the Slave Controller 3 takes time (this delay is shown as At in Figure 2), and since there are other uncertainties in program and hardware processing, the time synchronization of the Master Controller 2 and the Slave Controller 3 is handled by a standard mechanism that meets only the ASIL QM safety requirements. That is, it must be verified, i.e. ensured, that the difference in global time of the Master Controller 2 and the Slave Controller 3 is within a certain range. This would be feasible for safety requirements up to ASIL D.

[0078] The verification of time synchronization comprises the following checks in the master controller 2 and the slave controller 3: The global time t' of the master controller 2 when the predefined pin is pulled during the second cycle aM2 and, The global time t of the slave controller when a pull on the predefined pin is detected by the slave controller 3 during the second cycle. bs2 and Therefore, the master controller 2 checks whether the difference between the global time t' aM2 and the global time t of the slave controller 3 in the validation message sent from the slave controller 3 to the master controller 2. bs2 In other words, the slave controller 3 receives the global time t' in the verification message. aM2 sent back to Master Controller 2.

[0079] This check is performed to ensure that the global time of the master controller 2 and the global time of the slave controllers 3 are synchronized to meet safety integrity requirements, e.g. ASIL D.

[0080] Alternatively or additionally, the master controller 2 may determine the global time t' of the master controller 2 when the pull of the predefined pin is made.aM2 In addition to sending the global time t of the master controller 2 when the predefined pin is pulled, aM2 Capture and store.

[0081] The verification of the time synchronization then comprises carrying out the following checks in the master controller 2: The global time t captured by the master controller 2 during the second cycle aM2 and the global time t captured by the master controller 2 when the predefined pin is pulled during the first cycle. aM1 The difference between Local hardware counter C received by master controller 2 during the second cycle bs2 and the global time t of the slave controller 3 when a pull of the predefined pin is detected by the slave controller 3 during the first cycle and is also received by the master controller 2 during the second cycle. bs1 The local hardware counter C bs1 The difference between is less than a predefined second threshold value.

[0082] This will return the counter value, i.e. the local hardware counter C bs2 -C bs1 The difference between the elapsed time between the first and second cycles on the slave controller 3 and the elapsed time between the first and second cycles on the master controller 2 (i.e., t aM2 -t aM1 ) can be checked to see whether they are in sync (i.e., within tolerance (see above, e.g., ASIL D)).

[0083] The verification of the time synchronization comprises carrying out the following checks in the slave controller 3: The global time t' received by the slave controller 3 during the second cycle aM2and the global time t' received by the slave controller 3 during the first cycle. aM1 The difference between Local hardware counter C captured by slave controller 3 during the second cycle bs2 and the local hardware counter C captured by slave controller 3 during the first cycle. bs1 a global time t of the slave controller 3 when a pull of the predefined pin is detected by the slave controller 3 during the first cycle bs1 The local hardware counter C bs1 The difference between is less than a second predefined threshold value.

[0084] This means: Counter values ​​(i.e., the difference between the local hardware counters, C bs2 -C bs1 ) to find the elapsed time between the first and second cycles on slave controller 3, The global time difference (i.e., t') included in the follow-up message aM2 -t' aM1 ) to determine the elapsed time between the first and second cycles on Master Controller 2. It can be checked whether the are in sync (i.e. within tolerance (see above, e.g. ASIL D)).

[0085] It can also be checked whether the time synchronization of the master port 22 and the slave port 21 of the master controller 2 is synchronized, i.e. within the tolerance range (see above, for example ASIL D). The verification of the time synchronization therefore comprises the following checks: In the master controller 2, the global time t captured by the master controller 2 on the master port 22 when the pull of the predefined pin is made during the second cycle aM2 and, The global time t captured by the master controller 2 on the slave port 21 when the predefined pin is pulled during the second cycle. as2 and This check is performed in the first cycle of the method (t aM1 -t as1 <3rd threshold) can also be started.

[0086] Furthermore, in order to ensure the integrity of the communication path of the private bus 4, the time t aM2 (when a predefined pin is pulled and written in a follow-up message to the slave controller 3) is the global time t' aM2 (received by the slave controller 3 in a follow-up message and written in a verification message to the master controller 2). Here, the difference between these values ​​must be smaller than a predefined fourth threshold. aM2 and t' aM2 may differ since the transmit path of the master controller 3, the transmit path and the receive path of the slave controller 3 are realized only as ASIL QM using standard Autosar (AUTomotive Open System Architecture) mechanisms. This check is performed in the first cycle of the method (t' aM1 -t aM1 <4th threshold) can also be started.

[0087] The above tests can be summarized for the master controller 2 as follows:

number

[0088] The above mentioned checks can be summarized for the slave controller 3 as follows:

number

[0089] 1. Communication Network 2 Master Controller 21 Master Controller Slave Port 22 Master port of the master controller 3 Slave Controller 31 Slave port of the slave controller 4 Private Communication Bus 5. Further master controllers for further communication networks 51 Master port for additional master controllers GPIO General Purpose Input / Output t aM1 , t aM2 The global time of the master controller's master port clock, indicating when a predefined pin was pulled during the first or second cycle. t' aM1 , t' aM2 The global time on the master port of the master controller when a predefined pin pull occurs during the first or second cycle received by the slave controller t as1 , t as2 Global time of the slave ports of the master controller C bs1 , C bs2 A local hardware counter that corresponds to the global time of the slave controller when a pull on a predefined pin is detected by the slave controller on the first or second cycle t bs1 , t bs2 The global time of the slave controller when a pull on a predefined pin is detected by the slave controller on the first or second cycle.

Claims

1. A method for verifying time synchronization of at least two controllers connected to each other via a private bus (4), where one of the at least two controllers is a master controller (2) and another of the at least two controllers is a slave controller (3), said method comprising a number of cycles, where each cycle comprises: sending a follow-up message from the master controller (2) to the slave controller (3) in response to the pulling of a predefined pin of the master controller (2), wherein said follow-up message includes a global time (t') of the master controller (2) when the pull of the predefined pin was made; ａＭ２ ) from the master controller (2) to the slave controller (3); sending a validation message from the slave controller (3) to the master controller (2) in response to the received follow-up message, wherein the validation message includes a global time (t) of the slave controller (3) when a pull of a predefined pin was detected by the slave controller (3); ｂＳ２ ) from said slave controller (3) to the master controller (2); The global time (t') of the master controller (2) when the pull of the predefined pin is made. ａＭ２ )and, The global time (t) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3). ｂＳ２ verifying the time synchronization in the master controller (2) and / or in the slave controller (3) by checking whether the difference between the first and second time stamps is smaller than a predefined first threshold value; Equipped with capturing a global time (t aM2 ) of the master controller (2) when a pull of a predefined pin is made on said master controller (2); The validation message comprises a local hardware counter (c bs2 ) of the slave controller (3), where the local hardware counter (c bs2 ) corresponds to a global time (t bS2 ) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3); The step of verifying time synchronization includes: the difference between the global time (t aM2 ) captured by the master controller (2) when the predefined pin pull is made and the global time (t aM1 ) captured by the master controller (2) when the predefined pin pull is made in the previous cycle; the difference between a local hardware counter (c bs2 ) corresponding to the global time (t bS2 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) and a local hardware counter (c bS1 ) corresponding to the global time (t bS1 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) in the previous cycle; a check in the master controller (2) whether the difference between the first and second values ​​is smaller than a predefined second threshold value; The step of verifying time synchronization includes: the difference between the global time (t' aM2 ) of the master controller (2) received by the slave controller (3) in a follow-up message and the global time (t' aM1 ) of the master controller (2) received by the slave controller (3) in a follow-up message in the previous cycle; the difference between a local hardware counter (C bs2 ) corresponding to the global time (t bS2 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) and a local hardware counter (c bs1 ) corresponding to the global time (t bS1 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) in the previous cycle; a check in the slave controller (3) whether the difference between At least one of The verification message includes: a local hardware counter (C bs2 ) corresponding to the global time (t bS2 ) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3); a local hardware counter (C bs1 ) corresponding to the global time (t bS1 ) of the slave controller (3) when a pull on a predefined pin was detected by the slave controller (3) in the previous cycle; The method for verifying time synchronization of at least two controllers connected to each other via a private bus (4), the difference between which is included in the time synchronization of at least two controllers connected to each other via a private bus (4).

2. The master controller (2) has a master port and a slave port, and the master controller (2) is connected to a further bus via the slave port, and the slave port and the master port each have their own clock; The method further comprising: - synchronising the global time of the clock of the slave port (21) of the master controller (2) with the global time of the further bus; - synchronizing the global time of the clock of the master port (22) of a master controller (2) with the global time of the clock of the slave port (21) of said master controller (2); In the master controller (2), the global time (t ａＳ２ and capturing the wherein the step of verifying time synchronization comprises: The global time (t) of the master port (22) of the master controller (2) when a predefined pin pull is made, as captured by the master controller (2) on the master port. ａＭ２ )and, The global time (t) of the slave port (21) of the master controller (2) when a predefined pin pull is made, as captured by the master controller (2) on the slave port (21). ａＳ２ )and 2. The method according to claim 1, further comprising checking in the master controller (2) whether the difference between is less than a predefined third threshold value.

3. The global time (t) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3). ｂｓ２ ) and the local hardware counter (c ｂＳ２ After capturing the global time of the slave controller (3), the global time of the master controller (2) (t' ａＭ２ 3. The method of claim 1, further comprising the step of updating the data to the new data.

4. The verification message is sent in a follow-up message from the master controller (2) to the slave controller (3) at the global time (t' ａＭ２ ) The step of verifying time synchronization includes: The global time (t ａＭ２ )and, The global time (t') included in the verification message ａＭ２ )and 4. The method according to claim 1, further comprising the step of checking in the master controller (2) whether the difference between the first and second inputs is smaller than a fourth predefined threshold value.

5. A master controller (2) configured to be connected to a slave controller (3) via a private bus, The master controller (2), and further configured to transmit a follow-up message to the slave controller (3) via the private bus in response to the pulling of the predefined pin of the master controller (2), wherein the follow-up message includes a global time (t') of the master controller (2) when the pulling of the predefined pin was made. ａＭ２ ) The master controller (2), configured to receive a validation message from said slave controller (3) via a private bus in response to the sent follow-up message, wherein said validation message includes a global time (t) of the slave controller (3) when a pull of a predefined pin is detected by the slave controller (3). ｂＳ２ ) The master controller (2), The global time (t') of the master controller (2) when the pull of the predefined pin is made. ａＭ２ )and, The global time (t) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3). ｂＳ２ )and is further configured to verify the time synchronization of the global time of the slave controller (3) and the global time of the master controller (2) by checking whether the difference between the global time of the slave controller (3) and the global time of the master controller (2) is smaller than a predefined first threshold value; The validation message comprises a local hardware counter (c bs2 ) of the slave controller (3), where the local hardware counter (c bs2 ) corresponds to a global time (t bS2 ) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3); the master controller (2) is configured to capture a global time (t aM2 ) of the master controller (2) when a pull of a predefined pin is made; The master controller (2) the difference between the global time (t aM2 ) captured by the master controller (2) when the predefined pin pull is made and the global time (t aM1 ) captured by the master controller (2) when the predefined pin pull is made in the previous cycle; the difference between a local hardware counter (c bS2 ) corresponding to the global time (t bS2 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) and a local hardware counter (c bS1 ) corresponding to the global time (t bS2 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) in the previous cycle; is configured to verify the time synchronization of the global time of the slave controller (3) and the global time of the master controller (2) by checking whether the difference between the global time of the slave controller (3) and the global time of the master controller (2) is smaller than a predefined second threshold value; the validation message comprises a difference between a local hardware counter (c bS2 ) corresponding to a global time (t bS2 ) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3) and a local hardware counter (c bS1 ) corresponding to a global time (t bS2 ) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3) in a previous cycle; Master controller (2).

6. The master controller (2), - comprising a master port (22) and a slave port (21), each of the slave port (21) and the master port (22) comprising a clock; - connected to a further bus via a slave port (21), configured to synchronize the global time of the clock of the slave port (21) to the global time of the further bus, configured to synchronize the global time of the clocks of the master ports (22) with the global time of the clocks of the slave ports (21) of the master controller (2); - The global time (t ａＳ２ ) - The global time (t ａＭ２ )and, The global time (t ａｓ２ )and 6. The master controller (2) according to claim 5, configured to verify the time synchronization of the global time of the master controller (2) by checking whether the difference between

7. A slave controller (3) configured to be connected to a master controller (2) via a private bus, the slave controller (3) comprising: - configured to receive a follow-up message from the master controller (2) via the private bus in response to a pull of a predefined pin of the master controller (2), where the follow-up message includes a global time (t') of the master controller (2) when the pull of the predefined pin is made. ａＭ２ ) is included, - Detecting a pull of a predefined pin of the master controller (2) and recording the global time (t ｂＳ２ ) and The global time (t') of the master controller (2) included in the follow-up message ａＭ２ )and, The global time (t ｂＳ２ )and is configured to verify the time synchronization by checking whether the difference between The slave controller (3) - capturing a local hardware counter (c bS2 ) of the slave controller (3), said local hardware counter (c bS2 ) corresponding to a global time (t bS2 ) of the slave controller (3) when a pull on a predefined pin is detected by the slave controller (3); the difference between the global time (t' aM2 ) of the master controller (2) contained in the follow-up message and the global time (t' aM1 ) of the master controller (2) contained in the follow-up message in the previous cycle; the difference between the local hardware counter (c bS2 ) corresponding to the global time (t bS2 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) and the local hardware counter (c bS1 ) corresponding to the global time (t bS1 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) in the previous cycle; and verifying the time synchronization of the global time of the slave controller (3) and the global time of the master controller (2) by checking whether the difference between the global time of the slave controller (3) and the global time of the master controller (2) is smaller than a predefined second threshold. It is structured as follows: The slave controller (3) is configured to send a verification message including the local hardware counter (c bS2 ) of the slave controller (3) and the global time (t′ aM2 ) of the master controller (2) included in the follow-up message, whereby the master controller (2) the difference between the global time (t' aM2 ) of the master controller (2) contained in the validation message and the global time (t' aM1 ) of the master controller (2) contained in the validation message in the previous cycle; the difference between the local hardware counter (c bS2 ) corresponding to the global time (t bS2 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) and the local hardware counter (c bS1 ) corresponding to the global time (t bS1 ) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3) in the previous cycle; The slave controller (3) is capable of verifying the time synchronization of the global time of the slave controller (3) and the global time of the master controller (2) by checking whether the difference between the global time of the slave controller (3) and the global time of the master controller (2) is smaller than a predefined second threshold value.

8. The slave controller (3), - in response to the received follow-up message, sending a validation message to the master controller (2) via the private bus, wherein said validation message includes the global time (t) of the slave controller (3) when the pull of the predefined pin is detected by the slave controller (3). ｂＳ２ ), which allows the master controller (2) to: The global time (t') of the master controller (2) when the pull of the predefined pin is made. ａＭ２ )and, The global time (t) of the slave controller (3) when a pull of a predefined pin is detected by the slave controller (3). ｂＳ２ )and 8. The slave controller (3) according to claim 7, wherein the time synchronization can be verified with the master controller (2) by checking whether the difference between

9. The slave controller (3) has a local hardware counter (c ｂＳ２ ) and the global time (t ｂＳ２ After capturing the global time of the slave controller (3), the global time of the master controller (2) included in the follow-up message (t' ａＭ２ 9. A slave controller (3) according to claim 7 or 8, configured to update the master data to a master data set (Mdata) of the master data set (Mdata).

10. A master controller (2) according to claim 5 or 6, A slave controller (3) according to any one of claims 7 to 9; a private communication bus (4) interconnecting the master controller (2) and the slave controller (3); A communication network comprising: The communication network, wherein the private communication bus (4) comprises connections between predefined pins of the master controller (2) and the slave controllers (3).

Images