Fail-Silent Master Clock Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating synchronization messages in distributed real-time systems lack security and fault tolerance, particularly in using satellite signals, which can lead to errors and failures in master clocks.
Innovation Solution
A fail-silent master clock system utilizing three independent time sources: a satellite receiver, a central computer with a reference clock, and an independent monitor, where the satellite signal is used for normal operation, and the reference clock for anomalies, with an independent monitor ensuring message integrity by checking transmission time and intervals without opening the message, and modifying it to indicate errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If satellite signals are used for generating synchronization messages, then synchronization accuracy is improved, but system reliability deteriorates due to potential errors and security attacks
Solution Approach 1:
The system segments the time source into multiple independent components: satellite receiver (S signal), local reference clock (R signal), and independent monitor. Each component operates independently and can be validated separately, allowing the system to maintain synchronization accuracy while detecting and isolating faults in individual components.
Solution Approach 2:
An independent monitor acts as an intermediary that validates synchronization messages without opening or modifying them. This mediator checks transmission times and intervals against predetermined criteria, providing an additional layer of reliability verification while preserving the integrity of the satellite-based synchronization accuracy.
2Adaptability or versatility
If the message is opened to modify configuration parameters, then adaptability is improved, but error detection capability deteriorates due to potential transient errors during modification
Solution Approach 1:
The system performs preliminary validation of configuration parameters through the independent monitor before they are implemented. The monitor checks transmission times and intervals in advance, ensuring that parameter modifications meet predetermined criteria before affecting system operation, thus preventing erroneous modifications.
Solution Approach 2:
The independent monitor serves as an intermediary that validates configuration changes without requiring the message to be opened. By checking transmission metadata (times and intervals) externally, the system maintains both adaptability for parameter changes and reliability for error detection.
3Reliability
If an independent monitor checks each synchronization message, then reliability is improved, but device complexity increases
Solution Approach 1:
The monitoring function is extracted as a separate, independent unit from the central computer and satellite receiver. This independent monitor operates autonomously to validate synchronization messages, distributing system functions to reduce the complexity burden on any single component while improving overall reliability through specialized monitoring.
Solution Approach 2:
The independent monitor uses a separate reference clock (R signal) that is synchronized to the satellite signal, creating an independent copy of the time reference. This copied time base allows validation without requiring access to the original synchronization message contents, simplifying the monitoring architecture while maintaining fault detection capability.
4Measurement precision
If the reference clock is continuously adjusted to satellite signal, then synchronization accuracy is improved, but vulnerability to spoofing attacks increases
Solution Approach 1:
The independent monitor performs preliminary validation of satellite signal authenticity by checking transmission times and intervals against predetermined criteria before the reference clock adjusts to the satellite signal. This preliminary anti-action prevents spoofed signals from causing incorrect clock adjustments, countering the harmful effect before it can affect synchronization accuracy.
Solution Approach 2:
The independent monitor acts as an intermediary layer between the satellite receiver and the reference clock adjustment mechanism. It validates the authenticity of satellite signals through independent checking of transmission metadata, allowing the reference clock to safely adjust to verified signals while blocking adjustments based on spoofed signals.
Data Source
Figure 1
AI summary
The invention relates to a method for generating fail-silent synchronization messages in a distributed real-time system, said method using the following functional units: a satellite receiver (110) for receiving a time signal (S-signal) from a navigation satellite system, a precision reference clock (130) which generates an actual time signal (R-signal), a central computer (140), a monitor (120), and a data block (210) for storing configuration parameters. The satellite receiver (110) periodically generates an S-signal and the reference clock (130) periodically produces an R-signal, the nominal frequency and phase of the R-signal being identical to the frequency and phase of the S-signal and the difference between the nominal and actual R-signal being used to minimize said difference. In the event of a fault in the satellite receiver (110), the periodic synchronization message (220), which is to be generated by the central computer (140) in accordance with the configuration parameters (210), is generated on the basis of the R-signal and the monitor (120) checks whether the transmission time contained in the synchronization message matches the actual transmission time and the interval between two successive synchronization messages (220) lies within an a priori fixed tolerance interval. If this is not the case, the synchronization message (220) is modified such that each receiver identifies the synchronization message (220) as erroneous.