Verifying time synchronization

Abstract

A solution is provided for the verification of time synchronization in automated vehicle communication networks. [Solution] A method for verifying time synchronization in an automated vehicle communication network 1 includes sending a time synchronization message 6 including a master time from a master clock 5 to control units 22, 23, 25, 26 of a first communication network 2, synchronizing the local times of the control units 22, 23, 25, 26 with the received master time, sending the synchronized local times of the control units 22, 23, 25, 26 to a central validator 21, 24 of the first communication network 2, comparing the received synchronized local times of the control units 22, 23, 25, 26 with each other, and outputting an error message from the central validator 21, 24 to the automated vehicle if the difference between the received synchronized local times of the control units 22, 23, 25, 26 is greater than a predetermined threshold.

Description

[Technical Field]

[0001] The present invention relates to a method for verifying time synchronization in a communication network of automated vehicles and to an automated vehicle configured to perform the method. [Background technology]

[0002] As autonomous or automated vehicles become more complex, multiple communication buses are used by different electronic control units (ECUs) to ensure that the autonomous or automated driving functions meet the safety requirements necessary to meet, for example, the so-called Automotive Safety Integrity Level (ASIL).

[0003] Automotive Safety Integrity Level is a risk classification scheme defined by ISO 26262 - Functional Safety of Automotive Vehicles. The ASIL classification includes four safety levels, ranging from ASIL A, which has the lowest safety requirements, to ASIL D, which has the highest safety requirements. Hazards identified as QM do not specify any safety requirements.

[0004] All relevant controllers involved in critical decision-making for automated driving functions must have their time synchronized with other controllers. For example, for highly automated vehicles of SAE Level 3 or higher (SAE J3016 standard describes the classification and definition of terms for road vehicles with automated driving systems), time synchronization must meet ASIL B or higher.

[0005] In current technology, time synchronization on an Ethernet bus is performed according to IEEE 802.1AS for time sensitive network (TSN) and IEEE 1588 for Precision Time Protocol (PTP). However, in time synchronization with PTP, there are some measures taken in addition to the respective standards to ensure the integrity of the synchronization process and therefore the integrity of the distributed time base. Summary of the Invention [Problem to be solved by the invention]

[0006] In view of the current state of the art, it is an object of the present invention to provide a solution for verifying the time synchronization of communication networks of automated vehicles, preferably ensuring that a pre-defined safety integrity level, e.g. ASIL B or higher, is met. [Means for solving the problem]

[0007] The object is solved by the features of the independent claims. The dependent claims contain preferred further developments of the invention.

[0008] More specifically, the object is solved by a method for verifying time synchronization in a communication network of automated vehicles.

[0009] A vehicle can be an automated or autonomous vehicle, e.g., a vehicle with an automated system at SAE Level 3 or higher. At SAE Level 3 (i.e., "eyes off"), the driver can safely divert their attention from the driving task. For example, the driver can text or watch a video. The vehicle handles situations requiring a quick response, such as emergency braking. If requested by the vehicle, the driver must be prepared to intervene within a limited time frame defined by the manufacturer. The automated system is like a replacement driver that alerts the driver in an orderly manner when it is time for the driver to take control. One example is the Traffic Jam Chauffeur. At SAE Level 4 (i.e., "mind off"), the driver's attention is not required for safety. For example, the driver can safely sleep and leave the driver's seat. Automated driving is only supported in limited spatial domains (e.g., geofences) or under special circumstances. Outside that range or environment, the vehicle needs to be able to safely abort an operation, e.g., parking, if the driver does not regain control. One example is a robotaxi or robotic delivery service that covers only selected locations in a spatial domain. At SAE Level 5 (i.e., "steering wheel optional"), no human intervention is required. One example is a robotaxi that operates on all roads in all weather conditions, all year round, around the world.

[0010] The communication network includes a master clock and a first communication network of a first communication standard, the first communication network including at least two control units and a central validator.

[0011] That is, at least two control units and the central validator of the first communication network are connected to each other via a first bus, and the at least two control units and the central validator of the first communication network communicate with each other using a first communication standard.

[0012] The method includes transmitting a time synchronization message from a master clock to two control units of a first communication network, respectively, the time synchronization message including the master time.

[0013] In other words, the master clock, which may be implemented only as a QM, sends time synchronization messages to the first communication network so that the master time of the master clock can be used for time synchronization in the first communication network.

[0014] The method further includes synchronizing the local times of the two control units of the first communication network respectively to the received master time.

[0015] That is, each one of the two control units of the first communication network may include a local clock, i.e. a slave clock that is updated, for example periodically, with a master time received from the master clock.

[0016] The method further includes transmitting the synchronized local times of the two control units of the first communication network to a central validator of the first communication network, respectively.

[0017] That is, after updating, i.e., synchronizing, each of its slave clocks to the master time, each one of the two control units of the first communication network transmits its synchronized local time to the central validator of the first communication network.

[0018] The method further includes, at a central validator of the first communication network, comparing the received synchronized local times with each other, and if a difference between the received synchronized local times is greater than a first predetermined threshold, the central validator of the first communication network outputting an error message to the automated vehicle.

[0019] In other words, the central validator of the first communication network can be implemented at ASIL B or higher, for example ASIL D, and is configured to compare the synchronized times of the two control units of the first communication network with each other. In theory, the synchronized times of the two control units of the first communication network should be identical. However, due to latency (latency) in the communication network and / or hardware and / or software bugs, the synchronized times may differ from each other. If the difference determined by the central validator of the first communication network is within an acceptable range that depends on the safety integrity level (ASIL B or higher) of each central validator, no error flag is raised by each central validator. Otherwise, each central validator raises an error flag.

[0020] The method may further include sending a time synchronization message from the master clock to a central validator of the first communication network, and synchronizing a local time of the central validator of the first communication network with the received master time.

[0021] Thereafter, the method may further include, at the central validator of the first communication network, comparing the received synchronized local times of the two control units of the first communication network with the synchronized local time of the central validator of the first communication network, respectively, and the central validator of the first communication network outputting an error message to the automated vehicle if a difference between at least one of the received synchronized local times and the synchronized local time of the central validator of the first communication network is greater than a second predetermined threshold.

[0022] That is, the master time is transmitted from the master clock not only to the slave clocks of the two control units of the first communication network but also to the central validator of the first communication network. The central validator of the first communication network can therefore update its local time to the received master time, and therefore, in addition to the above-mentioned comparison of the local times of the two control units of the first communication network, the central validator of the first communication network can also use its own synchronized local time for comparison with the synchronized local times of the two control units of the first communication network. This can further improve the reliability of the time verification.

[0023] The communication network may further include a second communication network of a second communication standard, the second communication network including at least two control units and one central validator.

[0024] The method may further include transmitting a time synchronization message from the master clock to each of the two control units of the second communication network, similar to the method described above for the first communication network. The local times of the two control units of the second communication network may then be synchronized to the received master time. The two control units may then each transmit their synchronized local times to a central validator of the second communication network, so that the central validator of the first communication network can compare the received synchronized local times with each other and output an error message to the automated vehicle if the difference between the received synchronized local times is greater than a first predetermined threshold.

[0025] Again, the method may further include transmitting a time synchronization message from the master clock to a central validator of the second communication network, synchronizing a local time of the central validator of the second communication network with the received master time, comparing, at the central validator of the second communication network, the received synchronized local times of the two control units of the second communication network with the synchronized local time of the central validator of the second communication network, respectively, and outputting an error message from the central validator of the second communication network to the automated vehicle if a difference between at least one of the received synchronized local times and the synchronized local time of the central validator of the second communication network is greater than a second predetermined threshold.

[0026] The above explanations for the first communication network also apply to the second communication network. Furthermore, the solution allows providing two sub-networks, i.e., first and second communication networks, using different communication standards, both of which can meet the same safety integrity level, such that data, i.e., information provided by the two sub-networks, can be used together, e.g., in sensor data fusion for performing certain driver assistance functions of an automated vehicle.

[0027] The communication network may further include a third communication network of a third communication standard, and the third communication network may include the control unit.

[0028] Here, the central validator of the first communication network can also be connected to a third communication network and can be configured to act as a gateway control unit for the first and third communication networks.

[0029] That is, a central validator for a first communication network can also be provided for a third communication network. The central validator can be a gateway control unit, i.e., can enable data flow from the first communication network to a third communication network, where these networks use different communication standards. The gateway control unit can therefore include a protocol converter for converting, i.e., translating, data transmitted in the protocol used by the first communication standard into the protocol used by the third communication standard, and / or vice versa.

[0030] The method may further include transmitting a time synchronization message from the master clock to the control unit of the third communication network, synchronizing a local time of the control unit of the third communication network with the received master time, transmitting the synchronized local time of the control unit of the third communication network to a central validator of the first communication network, comparing, at the central validator of the first communication network, the received synchronized local time of the control unit of the third communication network with the received synchronized local time of the control unit of the first communication network, respectively, and outputting an error message from the central validator of the first communication network to the automated vehicle if a difference between the received synchronized local time of the control unit of the third communication network and at least one received synchronized local time of the control unit of the first communication network is greater than a predetermined first threshold.

[0031] In other words, the gateway control unit can be configured to implement the above-described method for the first communication network not only for the control units of the first communication network but also for the control units of the third communication network, thereby ensuring / verifying the time synchronization of the two communication networks.

[0032] The first communication network further includes at least two control units and a central validator.

[0033] The method may further comprise transmitting time synchronization messages from the master clock to two further (another) control units of the first communication network, respectively, synchronizing the local times of the two further control units of the first communication network with the received master time, respectively transmitting the synchronized local times of the two further control units of the first communication network to a further (another) central validator of the first communication network, comparing the received synchronized local times with each other at the further central validator of the first communication network, and outputting an error message from the further central validator of the first communication network to the automated vehicle if a difference between the received synchronized local times is greater than a predetermined first threshold.

[0034] The method may further include transmitting a time synchronization message from the master clock to a further central validator of the first communications network, synchronizing a local time of the further central validator of the first communications network with the received master time, comparing, at the further central validator of the first communications network, the received synchronized local times of the two further control units of the first communications network with the synchronized local time of the further central validator of the first communications network, respectively, and outputting an error message from the central validator of the second communications network to the automated vehicle if a difference between at least one of the received synchronized local times and the synchronized local time of the further central validator of the first communications network is greater than a second predetermined threshold.

[0035] That is, it is possible to provide more than one central validator for a communication network, and each one central validator provided for one of the communication networks can be connected to several control units of the respective communication network, i.e. several control units can be combined / grouped into one zone and a central validator can be provided for each zone, thus providing a scalable solution.

[0036] The method may further include transmitting the synchronized local time of the further central validator of the first communications network to the central validator of the first communications network, comparing at the central validator of the first communications network the synchronized local time of the further central validator of the first communications network with the local synchronized time of the central validator of the first communications network, and outputting an error message from the central validator of the first communications network to the automated vehicle if a difference between the synchronized local time of the further validator and the synchronized local time of the central validator of the first communications network is greater than a third predetermined threshold. Additionally or alternatively, the method may include transmitting the synchronized local time of the central validator of the first communications network to a further central validator of the first communications network, comparing at the further central validator of the first communications network the synchronized local time received by the central validator of the first communications network with the local synchronized time of the further central validator of the first communications network, and outputting an error message from the further central validator of the first communications network to the automated vehicle if a difference between the synchronized local time received by the central validator and the synchronized local time of the further central validator of the first communications network is greater than a third predetermined threshold.

[0037] The first, second and third thresholds may be the same value or may be different from each other.

[0038] That is, the central validator of the first communication network provided for each zone can not only verify the time synchronization in each zone, but also provide a cross-check of the time synchronization between each zone.

[0039] The method may further include checking in at least one control unit of the first, second and / or third communication networks whether a master time received in a time synchronization message from a master clock is valid, and outputting an error message from the at least one control unit to the automated vehicle if the received master time is not valid.

[0040] In other words, in addition to the verification of time synchronization being performed centrally at each central validator provided for each control unit, it is also possible to check the time synchronization locally at each control unit.

[0041] Additionally, an automated vehicle configured to perform the above-described method is provided.

[0042] The automated vehicle can include a communication network, which can include a master clock and a first communication network of a first communication standard, the first communication network including at least two control units and a central validator.

[0043] The master clock may be configured to send time synchronization messages to two control units of the first communication network respectively, the time synchronization messages including the master time.

[0044] The two control units of the first communication network may be configured to each synchronize their local time with the received master time.

[0045] The two control units of the first communication network may be configured to each transmit their synchronized local times to a central validator of the first communication network.

[0046] The central validator of the first communication network can be configured to compare the received synchronized local times with each other and output an error message to the automated vehicle if a difference between the received synchronized local times is greater than a first preset threshold.

[0047] Additionally, the master clock may be configured to transmit time synchronization messages from the master clock to a central validator of the first communications network.

[0048] The central validator of the first communication network may be configured to synchronize its local time with the received master time.

[0049] The central validator of the first communication network may be configured to compare the received synchronized local times of the two control units of the first communication network with its synchronized local times, respectively.

[0050] The central validator of the first communication network can be configured to output an error message to the automated vehicle if a difference between at least one of the received synchronized local times and the synchronized local time is greater than a second predetermined threshold.

[0051] The communication network may further include a second communication network of a second communication standard, the second communication network including at least two control units and one central validator.

[0052] The master clock may be configured to send time synchronization messages to two control units of the second communication network, respectively.

[0053] The two control units of the second communication network may be configured to each synchronize their local time with the received master time.

[0054] The two control units of the second communication network may be configured to each transmit their synchronized local times to a central validator of the second communication network.

[0055] The central validator of the second communication network can be configured to compare the received synchronized local times with each other and output an error message to the automated vehicle if a difference between the received synchronized local times is greater than a predetermined first threshold.

[0056] The master clock may be configured to transmit time synchronization messages to the second communications network.

[0057] The central validator of the second communication network may be configured to synchronize its local time with the received master time.

[0058] The central validator of the second communication network may be configured to compare the received synchronized local times of the two control units of the second communication network with its synchronized local times, respectively, and to cause the central validator of the first communication network to output an error message to the automated vehicle if a difference between at least one of the received synchronized local times and the synchronized local time of the central validator of the first communication network is greater than a second preset threshold.

[0059] The communication network may further include a third communication network of a third communication standard, the third communication network including the control unit.

[0060] The central validator of the first communication network can be connected to the third communication network and can be configured to act as a gateway control unit for the first and third communication networks.

[0061] The master clock may be configured to send time synchronization messages to the third communication network, in particular to a control unit of the third communication network.

[0062] The control unit of the third communication network may be configured to synchronize its synchronized local time with the received master time and transmit the synchronized local time to the central validator of the first communication network.

[0063] The central validator of the first communication network may be configured to compare the synchronized local times received by the control units of the third communication network with the synchronized local times received by the control units of the first communication network, respectively, and to output an error message to the automated vehicle if a difference between the synchronized local times received by the control units of the third communication network and at least one of the synchronized local times received by the control units of the first communication network is greater than a predetermined first threshold.

[0064] The first communication network further includes at least two control units and a central validator.

[0065] The master clock may be configured to send time synchronization messages to two further control units of the first communication network, respectively.

[0066] Two further control units of the first communications network may be configured to each synchronize their synchronized local times with the received master time and to each transmit their synchronized local times to a further central validator of the first communications network.

[0067] The further central validator of the first communication network may be configured to compare the received synchronized local times with each other and to output an error message to the automated vehicle if a difference between the received synchronized local times is greater than a predetermined first threshold.

[0068] The master clock may be configured to send time synchronization messages to a further central validator of the first communications network.

[0069] A further central validator of the first communication network may be configured to synchronize its local time with the received master time.

[0070] The further central validator of the first communications network may be configured to compare the received synchronized local times of two further control units of the first communications network with its synchronized local times, respectively.

[0071] The further central validator of the first communication network may be configured to output an error message to the automated vehicle if a difference between at least one of the received synchronized local times and the synchronized local time of the further central validator of the first communication network is greater than a second predetermined threshold.

[0072] The further central validator of the first communications network may be configured to transmit its synchronized local time to the central validator of the first communications network.

[0073] The central validator of the first communications network may be configured to compare the synchronized local time received by the further central validator of the first communications network with its local synchronized time, and to output an error message to the automated vehicle if a difference between the synchronized local time received by the further central validator of the first communications network and the synchronized local time of the central validator of the first communications network is greater than a third preset threshold.

[0074] Alternatively, or in addition, a central validator of a first communications network may be configured to transmit its synchronized local time to a further central validator of the first communications network.

[0075] The further central validator of the first communications network may be configured to compare the received synchronized local time of the central validator of the first communications network with its synchronized local time.

[0076] The further central validator of the first communications network may be configured to output an error message to the automated vehicle if a difference between the received synchronized local time of the central validator of the first communications network and the synchronized local time of the further central validator of the first communications network is greater than a third preset threshold.

[0077] At least one, at least some or all of the above-mentioned control units may be configured to check whether the master time received in the time synchronization message from the master clock is valid and to output an error message to the automated vehicle if the received master time is not valid.

[0078] Furthermore, the above description of the method also applies to the automated vehicle and vice versa.

[0079] The above description of the present invention can be summarized in other words as follows: A master clock provides synchronization messages to all nodes, i.e., all electronic control units (ECUs), via their respective communication buses, e.g., Ethernet, CAN-FD, LIN, and / or FlexRay. The master clock can be implemented solely by a QM. All safety-related ECUs, each with its own communication bus, must implement predefined local monitoring based on local clocks at safety integrity levels according to ASIL B or ASIL D. A master or multi-zone validator with different communication buses is implemented at ASIL D, and all nodes from the network send their respective synchronization status to the validator. There can be one or more multi-zone communication bus validators based on different ECUs and / or different communication buses. Synchronization of different multi-zone validators can be achieved by cross-checking the time synchronization of each clock, i.e., relative to each other, by forward and / or backward time synchronization. The validator checks all inputs and raises an error flag in case of a time synchronization discrepancy.

[0080] An embodiment of the present invention will now be described with reference to FIGS. [Brief explanation of the drawings]

[0081] [Figure 1] FIG. 1 is a diagram illustrating a schematic diagram of a communication network for an automated vehicle. [Figure 2] 2 shows a flowchart of a method for verifying time synchronization in the communication network shown in FIG. 1; DETAILED DESCRIPTION OF THE INVENTION

[0082] 1, the communication network 1 is divided into three subsystems: a first communication network 2, a second communication network 3 and a third communication network 4. Furthermore, the communication network 1 includes a master clock 5.

[0083] The first communication network 2 includes four control units 22, 23, 25, 26 and two central validators 21, 24 connected to one another via a bus 27, one of the central validators 21 serving two of the control units 22, 23 and the other central validator 24 serving the other two control units 25, 26. The first communication network 2 uses a first communication standard, for example Ethernet.

[0084] The second communication network 3 includes two control units 31, 32 and one central validator 33 connected to each other via a bus 34, the central validator 33 being provided for the two control units 31, 32. The second communication network 3 uses a second communication standard, for example FlexRay.

[0085] The third communication network 4 includes two control units 41, 42 connected to each other via a bus 43, and a central validator 24 of the first communication network 2 is also connected to the third communication network 4 via the bus 43 and is provided for the two control units 41, 42 of the third communication network 4. A third communication standard, for example CAN FD, is used in the third communication network 4. The central validator 24 of the first communication network 2 acts as a gateway control unit and is configured to convert between the first communication standard and the third communication standard.

[0086] By means of the above-described communication network 1, the automated vehicle is configured to carry out the method described with reference to FIG.

[0087] As can be seen from FIG. 2, the method for verifying time synchronization in a communication network 1 essentially comprises five steps S1 to S5.

[0088] In a first step S1 of the method, a time synchronization message 6 is sent from the master clock 5 to the first communication network 2, the second communication network 3 and the third communication network 4, respectively, the time synchronization message 6 including the master time.

[0089] In a second step S2 of the method, the local times of all control units 22, 23, 25, 26, 31, 41, 42 and of all central validators 21, 24, 33 are synchronized with the master time contained in the time synchronization message 6.

[0090] In a third step S3 of the method, the control units 22, 23 of the first communication network 2 each transmit their synchronized local times to the central validator 21 of the first communication network 2. The control units 25, 26 of the first communication network 2 and the control units 41, 42 of the third communication network 4 transmit their synchronized local times to the central validator 24 of the first communication network 2. The control units 31, 32 of the second communication network 3 transmit their synchronized local times to the central validator 33 of the second communication network 3. Furthermore, the two central validators 21, 24 of the first communication network 2 each transmit their synchronized local times to each other.

[0091] In a fourth step S4 of the method, each one of the central validators 21, 24, 33 compares the received local times of each of the control units 22, 23, 2, 26, 31, 32, 41, 42 with each other and with their respective local synchronized times. Furthermore, the two central validators 21, 24 of the first communication network 2 compare their synchronized local times with each other.

[0092] In a fifth step of the method, if one of the central validators 21, 24, 33 determines that the difference between the synchronized local times received by the control units 22, 23, 25, 26, 31, 32, 41, 42 and / or the difference between the synchronized local time received by the control units 22, 23, 25, 26, 31, 32, 41, 42 and the local time of the respective validator 21, 24, 33 is greater than a preset threshold, then each one of the central validators 21, 24, 33 outputs an error message to the automated vehicles.

[0093] Also, in a fifth step S5, if one of the two validators 21, 24 of the first communication network 2 determines that the difference between the synchronized local time received by the other of the two validators 21, 24 of the first communication network 2 and its own synchronized local time is greater than a preset threshold, each one of the validators 21, 24 outputs an error message to the automated vehicle.

[0094] Furthermore, in a fifth step S5, each one of the control units 22, 23, 25, 26, 31, 32, 41, 42 checks whether the master time received in the time synchronization message 6 from the master clock 5 is valid and outputs an error message to the automated vehicle if the received master time is not valid. The present invention may also include the following aspects: 1. A method for verifying time synchronization in an automated vehicle communication network (1), comprising: the communication network (1) includes a master clock (5) and a first communication network (2) of a first communication standard, a first communication network (2) comprising two control units (22, 23, 25, 26) and one central validator (21, 24); In the method, - sending (S1) a time synchronization message (6) from the master clock (5) to each of the two control units (22, 23, 25, 26) of the first communication network (2), the time synchronization message (6) containing the master time; - synchronizing (S2) the local times of the two control units (22, 23, 25, 26) of the first communication network (2) respectively with the received master time, - transmitting (S3) the synchronized local times of the two control units (22, 23, 25, 26) of the first communication network (2) respectively to a central validator (21, 24) of the first communication network (2); - comparing (S4) in a central validator (21, 24) of the first communication network (2) the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2) with each other; and outputting an error message (S5) from the central validator (21, 24) of the first communication network (2) to the automated vehicle if the difference between the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2) is greater than a first preset threshold value; A method comprising: 2.- Sending (S1) a time synchronization message (6) from the master clock (5) to a central validator (21, 24) of the first communication network (2); - synchronizing (S2) the local time of the central validator (21, 24) of the first communication network (2) with the received master time; - comparing (S3) in the central validator (21, 24) of the first communication network (2) the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2) with the synchronized local times of the central validator (21, 24) of the first communication network (2), respectively; and outputting an error message from the central validator (21, 24) of the first communication network (2) to the automated vehicle if the difference between at least one of the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2) and the synchronized local time of the central validator (21, 24) of the first communication network (2) is greater than a second preset threshold (S5); 1. The method according to claim 1, further comprising: 3. The method according to 1. or 2. above, the communication network (1) further includes a second communication network (3) of a second communication standard, the second communication network (3) comprises at least two control units (31, 32) and one central validator (33); In the method, - sending (S1) time synchronization messages (6) from the master clock (5) to the two control units (31, 32) of the second communication network (3), respectively; - synchronizing (S2) the local times of the two control units (31, 32) of the second communication network (3) respectively with the received master time, - transmitting (S3) the synchronized local times of the two control units (31, 32) of the second communication network (3) respectively to a central validator (33) of the second communication network (3); - comparing (S4) in a central validator (33) of the second communication network (3) the received synchronized local times of the two control units (31, 32) of the second communication network (3) with each other; and outputting (S5) an error message from a central validator (33) of the second communication network (3) to the automated vehicle if the difference between the synchronized local times received by the two control units (31, 32) of the second communication network (3) is greater than a first preset threshold value; The method further comprising: 4.- Sending (S1) a time synchronization message (6) from the master clock (5) to a central validator (33) of the second communication network (3); - synchronizing (S2) the local time of a central validator (33) of the second communication network (3) with the received master time; - in the central validator (33) of the second communication network (3), comparing (S3) the received synchronized local times of the two control units (31, 32) of the second communication network (3) respectively with the synchronized local time of the central validator (33) of the second communication network (3); and outputting an error message from the central validator (33) of the second communication network (3) to the automated vehicle if the difference between at least one of the synchronized local times received by the two control units (31, 32) of the second communication network (3) and the synchronized local time of the central validator (33) of the second communication network (3) is greater than a second preset threshold value; 3. The method according to claim 3, further comprising: 5. The method according to any one of 1. to 4. above, the communication network further includes a third communication network (4) of a third communication standard, - the third communication network (4) includes one control unit (41, 42); - the central validator (24) of the first communication network (2) is connected to the third communication network (4) and is configured to act as a gateway control unit for the first and third communication networks (2, 4); In the method, - sending (S1) a time synchronization message (6) from the master clock (5) to the control units (41, 42) of the third communication network (4); - synchronizing (S2) the local times of the control units (41, 42) of the third communication network (4) with the received master time, - transmitting (S3) the synchronized local times of the control units (41, 42) of the third communication network (4) to the central validator (24) of the first communication network (2); - comparing (S4) in the central validator (24) of the first communication network (2) the synchronized local times received by the control units (41, 42) of the third communication network (4) with the synchronized local times received by the control units (22, 23, 25, 26) of the first communication network (2), respectively; outputting (S5) an error message from the central validator (24) of the first communication network (2) to the automated vehicle if a difference between the synchronized local time received by the control units (41, 42) of the third communication network (4) and at least one of the synchronized local times of the control units (22, 23, 25, 26) of the first communication network (2) is greater than a first preset threshold value; The method further comprising: 6. The method according to any one of 1. to 5. above, the first communication network (2) further comprises two control units (22, 23) and one central validator (21); In the method, - transmitting (S1) time synchronization messages (6) from the master clock (5) to two further control units (22, 23) of the first communication network (2), respectively; - synchronizing (S2) the local times of two further control units (22, 23) of the first communication network (2) respectively with the received master time, - transmitting (S3) the synchronized local times of two further control units (22, 23) of the first communication network (2) respectively to a further central validator (21) of the first communication network (2), - comparing (S4) in a further central validator (21) of the first communication network (2) the received synchronized local times of two further control units (22, 23) of the first communication network (2) with each other, and outputting (S5) an error message from a further central validator (21) of the first communication network (2) to the automated vehicle if the difference between the synchronized local times received by two further control units (22, 23) of the first communication network (2) is greater than a first preset threshold value; The method further comprising: 7.- Sending (S1) a time synchronization message (6) from the master clock (5) to a further central validator (21) of the first communication network (2), - synchronizing (S2) the local time of a further central validator (21) of the first communication network (2) with the received master time, - in the further central validator (21) of the first communication network (2), comparing (S3) the received synchronized local times of the two further control units (22, 23) of the first communication network (2) with the synchronized local time of the further central validator (21) of the first communication network (2), respectively; and outputting an error message from the further central validator (21) of the first communication network (2) to the automated vehicle if the difference between at least one of the synchronized local times received by the two further control units (22, 23) of the first communication network (2) and the synchronized local time of the further central validator (21) of the first communication network (2) is greater than a second preset threshold value (S5). 6. The method according to claim 6, further comprising: 8.- Sending (S3) the synchronized local time of the further central validator (21) of the first communication network (2) to the central validator (24) of the first communication network (2); - comparing (S4) in the central validator (24) of the first communication network (2) the received synchronized local time of the further central validator (21) of the first communication network (2) with the local synchronized time of the central validator (24) of the first communication network (2); and outputting an error message from the central validator (24) of the first communication network (2) to the automated vehicle if the difference between the synchronized local time received by the further central validator (21) of the first communication network (2) and the synchronized local time of the central validator (24) of the first communication network (2) is greater than a third preset threshold (S5). and / or - transmitting (S3) the synchronized local time of the central validator (24) of the first communication network (2) to a further central validator (21) of the first communication network (2); - in the further central validator (21) of the first communication network (2), comparing (S4) the received synchronized local time of the central validator (24) of the first communication network (2) with the local synchronized time of the further central validator (21) of the first communication network (2), and outputting an error message from the further central validator (21) of the first communication network (2) to the automated vehicle if the difference between the synchronized local time received by the central validator (24) of the first communication network (2) and the synchronized local time of the further central validator (21) of the first communication network (2) is greater than a third preset threshold (S5). Further comprising 7. The method according to claim 7, characterized in that: 9. - checking (S5) in at least one control unit (22, 23, 25, 26, 31, 32, 41, 42) of the first, second and / or third communication network (2, 3, 4) whether the master time received in the time synchronization message (6) from the master clock (5) is valid; and outputting an error message from at least one control unit (22, 23, 25, 26, 31, 32, 41, 42) to the automated vehicle if the received master time is invalid (S5); The method according to any one of 1. to 8. above, further comprising: 10. An automated vehicle configured to carry out the method described in any one of 1. to 9. above. [Explanation of symbols]

[0095] 1. Communication Network 2. First Communication Network 3. Second Communication Network 4. The third communication network 5 Master Clock 6 Time Synchronization Messages 21, 24, 33 Central Validator 22, 23, 25, 26, 31, 32, 41, 42 Control unit

Claims

1. A method for verifying time synchronization in an automated vehicle communication network (1), comprising: - the communication network (1) comprises a master clock (5) and a first communication network (2) of a first communication standard, said first communication network (2) comprising two control units (22, 23, 25, 26) and one central validator (21, 24); In the method, - sending (S1) a time synchronization message (6) from said master clock (5) to each of said two control units (22, 23, 25, 26) of said first communication network (2), said time synchronization message (6) containing the master time; - synchronizing (S2) the local times of the two control units (22, 23, 25, 26) of the first communication network (2) respectively with the received master time; - transmitting (S3) the synchronized local times of the two control units (22, 23, 25, 26) of the first communication network (2) respectively to the central validator (21, 24) of the first communication network (2); - comparing (S4) in the central validator (21, 24) of the first communication network (2) the received synchronized local times of the two control units (22, 23, 25, 26) of the first communication network (2) with each other; and outputting (S5) an error message from the central validator (21, 24) of the first communication network (2) to the automated vehicle if the difference between the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2) is greater than a first preset threshold value; Including, - said communication network further comprises a second communication network (4) of a second communication standard, - the second communication network (4) comprises one control unit (41, 42), the central validator (24) of the first communication network (2) is connected to the second communication network (4) and is configured to act as a gateway control unit for the first and second communication networks (2, 4); - sending (S1) a time synchronization message (6) from said master clock (5) to said control units (41, 42) of said second communication network (4); - synchronizing (S2) the local times of the control units (41, 42) of the second communication network (4) with the received master time, - transmitting (S3) the synchronized local time of the control units (41, 42) of the second communication network (4) to the central validator (24) of the first communication network (2); - comparing (S4) in the central validator (24) of the first communication network (2) the synchronized local times received by the control units (41, 42) of the second communication network (4) with the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2), respectively; and outputting (S5) an error message from the central validator (24) of the first communication network (2) to the automated vehicle if the difference between the synchronized local time received by the control unit (41, 42) of the second communication network (4) and at least one of the synchronized local times of the two control units (22, 23, 25, 26) of the first communication network (2) is greater than a first preset threshold value; The method further comprising:

2. - sending (S1) a time synchronization message (6) from said master clock (5) to said central validator (21, 24) of said first communication network (2); - synchronizing (S2) the local time of the central validator (21, 24) of the first communication network (2) with the received master time; - in the central validator (21, 24) of the first communication network (2), comparing (S3) the received synchronized local times of the two control units (22, 23, 25, 26) of the first communication network (2) with the synchronized local time of the central validator (21, 24) of the first communication network (2), respectively; and outputting (S5) an error message from the central validator (21, 24) of the first communication network (2) to the automated vehicle if the difference between at least one of the synchronized local times received by the two control units (22, 23, 25, 26) of the first communication network (2) and the synchronized local time of the central validator (21, 24) of the first communication network (2) is greater than a second preset threshold value; 10. The method of claim 1, further comprising:

3. 3. The method of claim 1 or 2, - the communication network (1) further comprises a third communication network (3) of a third communication standard, - said third communication network (3) comprises at least two control units (31, 32) and one central validator (33); In the method, - sending (S1) time synchronization messages (6) from said master clock (5) to said two control units (31, 32) of said third communication network (3), respectively; - synchronizing (S2) the local times of the two control units (31, 32) of the third communication network (3) respectively with the received master time; - transmitting (S3) the synchronized local times of the two control units (31, 32) of the third communication network (3) respectively to the central validator (33) of the third communication network (3); - comparing (S4) in the central validator (33) of the third communication network (3) the received synchronized local times of the two control units (31, 32) of the third communication network (3) with each other; and outputting (S5) an error message from the central validator (33) of the third communication network (3) to the automated vehicle if the difference between the synchronized local times received by the two control units (31, 32) of the third communication network (3) is greater than a first preset threshold value; The method further comprising:

4. - sending (S1) a time synchronization message (6) from said master clock (5) to said central validator (33) of said third communication network (3); - synchronizing (S2) the local time of said central validator (33) of said third communication network (3) with the received master time; - in the central validator (33) of the third communication network (3), comparing (S3) the received synchronized local times of the two control units (31, 32) of the third communication network (3) with the synchronized local time of the central validator (33) of the third communication network (3), respectively; and outputting an error message from the central validator (33) of the third communication network (3) to the automated vehicle if the difference between at least one of the synchronized local times received by the two control units (31, 32) of the third communication network (3) and the synchronized local time of the central validator (33) of the third communication network (3) is greater than a second preset threshold value; 4. The method of claim 3, further comprising:

5. The method according to any one of claims 1 to 4, - said first communication network (2) further comprises two control units (22, 23) and one central validator (21); In the method, - sending (S1) time synchronization messages (6) from said master clock (5) to said two further control units (22, 23) of said first communication network (2), respectively; - synchronizing (S2) the local times of the two further control units (22, 23) of the first communication network (2) respectively with the received master time, - transmitting (S3) the synchronized local times of the two further control units (22, 23) of the first communication network (2) respectively to the further central validator (21) of the first communication network (2); - in the further central validator (21) of the first communication network (2), comparing (S4) the received synchronized local times of the two further control units (22, 23) of the first communication network (2) with each other; and outputting (S5) an error message from the further central validator (21) of the first communication network (2) to the automated vehicle if the difference between the received synchronized local times of the two further control units (22, 23) of the first communication network (2) is greater than a first preset threshold value; The method further comprising:

6. - sending (S1) a time synchronization message (6) from said master clock (5) to said further central validator (21) of said first communication network (2); - synchronizing (S2) the local time of said further central validator (21) of said first communication network (2) with the received master time; - in the further central validator (21) of the first communications network (2), comparing (S3) the received synchronized local times of the two further control units (22, 23) of the first communications network (2) with the synchronized local time of the further central validator (21) of the first communications network (2), respectively; and outputting (S5) an error message from the further central validator (21) of the first communication network (2) to the automated vehicle if the difference between at least one of the synchronized local times received by the two further control units (22, 23) of the first communication network (2) and the synchronized local time of the further central validator (21) of the first communication network (2) is greater than a second preset threshold value; 6. The method of claim 5, further comprising:

7. - transmitting (S3) the synchronized local time of the further central validator (21) of the first communication network (2) to the central validator (24) of the first communication network (2); - in the central validator (24) of the first communication network (2), comparing (S4) the received synchronized local time of the further central validator (21) of the first communication network (2) with the local synchronized time of the central validator (24) of the first communication network (2); and outputting (S5) an error message from the central validator (24) of the first communication network (2) to the automated vehicle if the difference between the received synchronized local time of the further central validator (21) of the first communication network (2) and the synchronized local time of the central validator (24) of the first communication network (2) is greater than a third preset threshold value; and / or - transmitting (S3) the synchronized local time of the central validator (24) of the first communication network (2) to the further central validator (21) of the first communication network (2); - in the further central validator (21) of the first communications network (2), comparing (S4) the received synchronized local time of the central validator (24) of the first communications network (2) with the local synchronized time of the further central validator (21) of the first communications network (2); and outputting (S5) an error message from the further central validator (21) of the first communication network (2) to the automated vehicle if the difference between the synchronized local time received by the central validator (24) of the first communication network (2) and the synchronized local time of the further central validator (21) of the first communication network (2) is greater than a third preset threshold value; Further comprising The method according to claim 6, characterized in that

8. - checking (S5) in at least one of the control units (22, 23, 25, 26, 31, 32, 41, 42) of the first, second and / or third communication networks (2, 4, 3) whether the master time received in a time synchronization message (6) from the master clock (5) is valid; and outputting an error message from at least one of said control units (22, 23, 25, 26, 31, 32, 41, 42) to said automated vehicle if the received master time is not valid (S5); 5. The method of claim 3 or 4, further comprising:

9. An automated vehicle configured to carry out the method according to any one of claims 1 to 8.

Images