WO2006129269A2

WO2006129269A2 - Method to synchronize locally provided clocks of different communication nodes of a time-triggered communication system

Info

Publication number: WO2006129269A2
Application number: PCT/IB2006/051712
Authority: WO
Inventors: Joern Ungermann
Original assignee: Philips Intellectual Property & Standards Gmbh; Koninklijke Philips Electronics N.V.
Priority date: 2005-06-02
Filing date: 2006-05-30
Publication date: 2006-12-07
Also published as: WO2006129269A3

Abstract

Fault-tolerant communication systems use distributed clock synchronization algorithms for generating independent and stable clock sources. When these communication system must be aligned to an external clock, this requires a coordinated effort through all the participating nodes. The presented method proposes an efficient and flexible way for aligning a communication cluster with another one (or multiple ones) or external real time clocks using only minimal bandwidth and hardware resources. Nodes having access to the external clock or the other communication cluster distribute the information necessary for a collective shift throughout the communication cluster.

Description

Method to synchronize locally provided clocks of different communication nodes of a time-triggered communication system

A typical fault-tolerant time-triggered communication system consists of several communication nodes which are connected via channels, which can be developed redundant with several channels.

These systems are at least partially time-triggered, meaning that the time derived from the locally in the communication nodes provided clocks is divided into recurring cycles, where each cycle consists in particular of several segments. For fault- tolerance, each node determines the start of a new cycle according to its own built-in clock and is thereby not dependent on a central master.

At least one segment of the communication cycle is divided into a fixed number of slots, where each slot is assigned up to at most one communication controller, wherein that communication controller and alone that communication controller has the right to transmit (exclusive assignment).

Each node derives the cycle start from its own clock. By a distributed, fault-tolerant algorithm, all nodes in the cluster align their clocks to each other. Using these synchronized clocks, they align the cycle start and optionally also the length of a cycle (thereby reducing the need for cycle start adjustments in the future). This is called offset and - in case of also determining the length of the communication cycle - rate correction. The Time-Triggered Protocol (TTP) i.e. is a system, where only offset correction is used, while the FlexRay protocol i.e. uses both offset and rate correction. The EP 1 280 024 Al proposes a method to synchronizing nodes of a distributed system for real time applications, where nodes are interconnected by a communication link and each of the nodes includes a local clock, wherein time deviations between its own local clock and all other nodes of the subset of nodes are being measured by the difference between an expected receiving time of a received message and an actual receiving time observed based on the time of its own local clock. The EP 1 355 459 A2 proposes a method for synchronizing clocks in a distributed communication system comprising at least one communication media and a number of nodes connected to the communication media, whereas the nodes comprise the clocks, wherein for synchronizing the clocks differences in offset of the clocks as well as differences in rate of the clocks are corrected

In the case that a cluster has to be synchronized to an external influence, like a real clock or another communication cluster connected to the communication system, all nodes of the cluster must agree with each other to shift the cycle start or modify the cycle length in a certain way, to be aligned to the external influence. In case that not all nodes of the cluster perform the correction, the fault-tolerant synchronization will generally prevent the cluster from achieving synchronicity with the external influence. This is an inbuilt function of the fault-tolerant clock synchronization - the system is supposed to be very stable against the (possibly erroneous) influence of only a minority of its participants. Therefore, it is necessary for (almost) all nodes of the communication system to agree upon the adjustments that shall be applied for aligning to the external influence. Erroneous nodes need not do so - the communication system must still be stable in the presence of a small set of non- conforming nodes.

This agreement regarding the amount of adjustment is traditionally done in the host application domain and is therefore prone to communication delays deriving from non-optimal slot assignment and constraints imposed by the workload of the host. It is therefore difficult to achieve fast decision for optimal alignment to the external influence, which is very important for closely aligning two communications clusters with one another. It is a technical purpose of the invention is to develop a method that synchronizes locally provided clocks of different communication nodes of a plurality of at least two communication nodes connected via at least one channel of a time-triggered communication system, plus a communication system that can be used to execute said method. The invention' s technical purpose is met by the proposed method to synchronize locally provided clocks of different communication nodes of a plurality of at least two communication nodes connected via at least one channel of a time-triggered communication system exchanging repeatedly data organized in frames, wherein preferred communication nodes among the communication nodes have a connection to an external clock source of increased accuracy, wherein the sending of frames of different communication nodes is scheduled in different slots of at least one segment of recurring cycles in which the time is divided, each preferred communication node from at least a subset of all preferred communication nodes performs the following steps: - comparing the locally provided clock with the clock source of increased accuracy, including a correction information at a predetermined location within the frame that is to be sent by the preferred communication node in its slot, setting a correction signal in the frame indicating that the locally provided clock is slow, is fast or is synchronous compared to the clock source of increased accuracy, wherein a time deviation between its own local clock and the clock source of increased accuracy is determined and the amount of deviation is specified in predetermined steps together with the correction signal, each communication node from at least a subset of all communication nodes performs the following steps: reading out the correction information of the frames received from the actual sending communication node or preferred communication node during the running cycle, - adding the amounts of the correction information to a value list, calculating a correction value which is derived from the value list for shifting the next cycle start.

The proposed method includes an efficient mechanism in particular into the communication controller of fault-tolerant protocols and thereby effectively extending their functionality for external clock correction and alignment to be used e.g. for gateway applications. It uses preferably known and proven fault-tolerant algorithms for ensuring maximum safety. This leads to only very limited bandwidth consumption and provides thereby an advantageous, differentiating add-on feature.

This invention proposes to use additional information i.e. from the payload of transmitted frames to autonomously perform clock alignment within the communication controller without additional exchange of information with the host application. The host application is only needed in a small set of nodes (at least one) for providing the external influence that is then distributed to all nodes in the network.

In a preferred embodiment of said invention, the predetermined steps in which the amount of deviation is specified represent a fixed amount of real time. This ensures that time deviations are calculated by the different nodes on the same basis.

In a preferred embodiment of said invention, the correction information is a two bit information, wherein a high level of the first bit means that the local clock should be delayed and a high level of the first bit means that the local clock should be brought forward and a low level of both bits means that the local clock is in time.

In a preferred embodiment of said invention, the value list comprise two counters counter_plus and counter_minus wherein at any occurrence of a signal that the local clock should be delayed the counter counter_minus is increased or the amount of the correction signal is added if the correction signal is larger than one bit and at any occurrence of a signal that the local clock should be brought forward the counter counter_plus is increased or the amount of the correction signal is added if the correction signal is larger than one bit. The advantage of this proposed step of the invention is, that in a very simple way the individual correction signals can be evaluated. The calculation is carried out in another inventive step by common redundant algorithms. The advantage is the very safe computation of the results.

It is very advantageous that the calculation of the correction value is derived through a comparison of the values of counter_plus and counter_minus, wherein the cycle start is delayed if counter_minus is larger and the cycle start is brought forward if counter_plus is larger. That means, if one counter is larger than the other, a correction shall be performed. If both counters are equal, no correction shall be performed. This makes it very easy to perform the comparison and saves overhead. The measure as defined in of claim 9 has the advantage that trusted external clocks can be weighted.

The measure as defined in of claim 11 has the advantage that no overhead in the data stream is generated. In a preferred embodiment of said invention, the time deviation being determined by measuring the difference between the local time of the local clock and the external time of the clock source of increased accuracy,

The measure as defined in of claim 14 has the advantage that other communication systems that use a trusted time can be used for synchronization. The measure as defined in of claim 15 has the advantage that common and globally available signals are used.

In a preferred embodiment of said invention, a correction of the length of the cycle is done by the same procedure. The last part of the technical purpose of the invention is met by a communication system according to Claim 18, which uses a distributed clock synchronization for performing the method according to one of the claims 1 to 16 characterized in, that there are a plurality of communication nodes, which are connected via at least one channel, wherein at least one preferred communication node among the communication nodes has a connection to an external clock source of increased accuracy, and that there are means provided to compare the locally provided clock with the clock source of increased accuracy.

These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment described hereinafter. Brief description of the drawing, with communication system

Fig. 1 showing a scheme of the architecture of a communication node according to the invention, and

Fig. 2 showing a scheme of the architecture of a communication system to be used to perform the method according to the invention with a to be synchronized communication node and a preferred communication node connected to a clock source of increased accuracy. As shown in Fig. 1, a communication node 7 consists of an application host 1 and a communication controller 2 connected to a pair of redundant channels 5 and 6. The communication controller 2 comprises a controller host IF and a protocol engine. There could bus drivers, and bus guardian devices for each bus driver be present, that are not shown for better understanding.

The presence of the single parts or the described embodiment of the communication node 7 is only exemplary, for the invention, only the communication controller 2 and the application host 1 are of importance. The bus driver and the bus guardian are only listed to provide a better understanding, in which context the invention might be used. The invention is not limited or restricted by the presence or absence of these devices.

The bus driver transmits the bits and bytes that the communication controller provides onto a connected channel 5 or 6 (an electrical or optical physical medium) and in turn provides the communication controller 2 with the information it receives on the channel. The communication controller 2 delivers relevant data to the host application 1 and receives data from it that it in turn assembles to frames and delivers to the bus driver which drives the channel.

Fig. 2 shows a communication system 11 built up of two communication nodes 7 and 8, wherein one communication node 8 is a preferred one since it is connected via a data line 9 to an external clock source 10 of increased accuracy from which it gets trusted time information.

The communication system 11 is time-triggered, meaning that the time is divided into recurring cycles, where each cycle consists of several segments. A typical segment of the communication cycle is divided into a fixed number of slots, where each slot is assigned up to at most one communication controller, wherein that communication controller of node 7 or 8 and alone that communication controller is assigned to transmit exclusively. Other segments of the cycle can be used for dynamic arbitration schemes or other purposes.

The bus guardian is a device with an independent set of configuration data that enables the transmission on the bus only during those slots, which are specified by the configuration set. The configuration set is precalculated at design time of the system and especially secured against changes. The host application contains the data source and sink and is generally not concerned with the protocol activity. Only decisions that the communication controller cannot do alone are made by the host application. The used protocol could be for example the TTP or as well the FlexRay protocol. If a communication system (cluster) consists of n nodes preferably from these n nodes, m nodes are connected to an external clock source. This clock source may be another communication cluster (of the same or a different protocol) or another clock, e.g. derived from a GPS signal.

In a fault-tolerant communication system, m will be preferably chosen to be larger than 1 to prevent a single point of failure. At least m = 4 is required to be resilient against a single so called Byzantine failure.

The method according to the invention is explained according to some exemplary embodiments:

Each communication controller of the communication nodes is configured with the location of two bits B within the frame payload. When using the FlexRay protocol these two bits are preferably located within the network management vector. Each communication controller is configured with a correction value c. By preconfiguring this information, as an additional advantage bandwidth is saved. This correction value c corresponds approximately to a fixed amount of real time, as close as this is possible given the implementations.

According to a specific embodiment of the invention each communication controller may have two counters, counter_plus and counter_minus. At the beginning of a communication cycle, each communication controller sets both counters to zero. On frame transmission, only nodes of a set connected to an external clock source are allowed to set the bits B to anything but zero. The application hosts from the set connected to an external clock source choose one frame eligible for transmission per communication cycle and proceed as follows:

• If the cycle start shall be delayed by c or more, it sets the first bit of B within this frame to one. • If the cycle start shall be brought forward by c or more, it sets the second bit of B within this frame to one. • If no additional correction shall be performed, they set neither bit to one. For all communication controllers is valid:

• If a frame with a set first bit (of B) is commanded to be sent or is received, the counter counter_plus is increased. • If a frame with a set second bit is commanded to be sent or is received, the counter counter_minus is increased.

Before the end of the current communication cycle, both counters are compared to each other. If one counter is larger than the other, a correction shall be performed. If both counters are equal, no correction shall be performed. If counter_plus is larger than counter_minus, the cycle start is delayed by c. If counter_minus is larger than counter_plus, the cycle start is brought forward by c. To be even more fault- tolerant, additional restrictions can be implemented towards which frames are evaluated for counter increasing. For communication systems within which each node is only entitled to transmit at most one frame per cycle this is not necessary. To be more concrete, if the nodes A, B, C, D, E, F are part of the set N.

The nodes A, B and C are part of the set with a connection to a clock source of increased accuracy. All nodes are configured to shift the cycle start by c = 5 ticks (it is assumed that the tick length is the same in all nodes).

In communication cycle one, nodes A and B set the first bit of B to one, whereas node C sets the second bit of B to one (due to a fault or different data).

As a result the counter counter_plus of all nodes is 2 whereas the counter counter_minus of all nodes is 1. As a result, all nodes bring the next cycle start five ticks forward in addition to their normal cycle start alignment.

If the communication system also performs cycle length adjustment, additional two bits may exist: B_s for cycle start adjustment and Bi for cycle length adjustment and also two times two counters: counter_plus,l , counter_minus,l , counter_plus,s , counter_minus,s

In communication cycle one, nodes A and B set the first bit of B_s to one, whereas node C sets the second bit of B_s to one (due to a fault or different data). In communication cycle one, nodes A, B and C set the second bit of Bi to one. The counter counter_plus,s of all nodes is 2 whereas the counter counter_minus,s of all nodes is 1. As a result, all nodes bring the next cycle start five ticks forward in addition to their normal cycle start alignment.

The counter counter_plus,s of all nodes is 3 whereas the counter counter_minus,s of all nodes is 0. As a result, all nodes will generally prolong their cycles by 5 ticks from the next cycle on in addition to their normal cycle length adjustment.

If the so called FlexRay protocol is used, the additional restriction to only evaluate synchronization frames does not impose practical restrictions but increases greatly the fault-tolerance of the mechanism. In this case, the host application shall naturally choose only synchronization frames for setting the bits B. With more than four communication nodes within the communication system connected to a clock source of increased accuracy, one Byzantine fault can then be tolerated.

In the following section the method according to the invention will be described for correcting the cycle start with the help of a second example:

At the beginning of a communication cycle, the list values is emptied. Only nodes of a set connected to an external clock source of increased accuracy are allowed to set the bits B to anything but zero. The application hosts from the before mentioned set choose one frame eligible for transmission per communication cycle and proceed as follows:

• If the cycle start shall be shifted, they set B to the signed shift required. Should the shift be larger than can be expressed by b bits, the maximal shift that can be expressed within b bits shall be chosen instead.

• If no additional correction shall be performed, they set all bits to a special bit combination indicating, that the amount of required correction is zero.

An implementation example for three bits B may have the following values:

(00O)₂ means, no correction value present.

Valid correction values are expressed by: (Hl)₂ = -3, (110)₂=-2, (101)₂=-l, (10O)₂=O, (001)₂=+l, (010)₂=+2,

(011)₂=+3 For this to work, all communication controllers need to be able to access a common unit in time small enough to be useful for the task of shifting the cycle start. If the communication controllers run all with the same clock speed, this frequency may be the base unit. Should this not be feasible, each node must be configured in a way to derive from the values of the value list a meaningful number of own clock ticks.

For all communication controllers is valid:

• If a frame is commanded to be sent or is received where not all bits B are zero, value of B is added to the value list.

Before the end of the current communication cycle, which could be an instance in time after the last frame that could carry another value could have arrived and still early enough to shift the cycle start by an additional maximum correction, a correction value is derived from the value list for shifting the cycle start.

For deriving this value, known fault-tolerant algorithms can be used. To give a few examples, the fault-tolerant-average algorithm (FTA) or the fault-tolerant- midpoint algorithm (FTM) can be used, whereas the FTM is preferred since it poses the least requirements on the hardware.

To be even more fault-tolerant, additional restrictions can be implemented towards which frames are evaluated for counter increasing. For communication systems within which each node is only entitled to transmit at most one frame per cycle this is not necessary.

If the FlexRay protocol is used, the above mentioned may be considered adapted to this example as well.

To be again more concrete, if the nodes A, B, C, D, E, F are part of the set N. The nodes A, B, C and D are part of the set with a connection to a clock source of increased accuracy.. It is assumed that the tick length is the same in all nodes. B consists of 4 bits.

In communication cycle one, node A sets B to 5. Node B sets B to -1. Node C wants to set B to 31 but is restricted to set it only to 7.

Node D sets B to 7. As a result the list values of all nodes contains the values [-1,5,7,7]. Depending on the used algorithm values between -1 and 7 will be derived from the list. If the FTM is used, the highest and lowest values are removed and the arithmetic average of the new highest and lowest values is calculated. This would be 6. As a result all nodes will delay the next cycle start by six ticks in addition to their normal cycle start alignment.

If the inventive method is not implemented within all communication controllers of a communication system, the host application can perform this job instead of these. This requires that all frames containing external clock correction information must be made available to the host application for generating the appropriate correction value, which must then in turn be communicated to the communication controller in time for the correction.

This may be a work-around until all communication controllers support this mechanism. If the FlexRay protocol is uses this would require that the frames used for communicating the correction values or the respective information are known in advance and be configured into the non- supporting nodes. The host application of these nodes must then configure these frames as reception slots and extract the correction information out of these frames and configure the external correction factor correspondingly.

Claims

CLAIMS:

1. Method to synchronize locally provided clocks of different communication nodes (7, 8) of a plurality of at least two communication nodes connected via at least one channel (5, 6) of a time-triggered communication system (11) exchanging repeatedly data organized in frames, wherein preferred communication nodes (8) among the communication nodes (7, 8) have a connection (9) to an external clock source (10) of increased accuracy, wherein the sending of frames of different communication nodes is scheduled in different slots of at least one segment of recurring cycles in which the time is divided, each preferred communication node from at least a subset of all preferred communication nodes performs the following steps: comparing the locally provided clock with the clock source of increased accuracy, - including a correction information at a predetermined location within the frame that is to be sent by the preferred communication node in its slot, setting a correction signal in the frame indicating that the locally provided clock is slow, is fast or is synchronous compared to the clock source of increased accuracy, wherein a time deviation between its own local clock and the clock source of increased accuracy is determined and the amount of deviation is specified in predetermined steps together with the correction signal, each communication node from at least a subset of all communication nodes performs the following steps: reading out the correction information of the frames received from the actual sending communication node or preferred communication node during the running cycle, adding the amounts of the correction information to a value list, - calculating a correction value which is derived from the value list for shifting the next cycle start.

2. Method according to claim 1, wherein the predetermined steps in which the amount of deviation is specified represent a fixed amount of real time.

3. Method according to claim 1 or 2, wherein the correction information is a two bit information, wherein a high level of the first bit means that the local clock should be delayed and a high level of the first bit means that the local clock should be brought forward and a low level of both bits means that the local clock is in time.

4. Method according to claim 3, wherein the predetermined steps in which the amount of deviation is specified are the three possible states of the correction information

5. Method according to one of the previous claims, wherein the value list comprise two counters counter_plus and counter_minus wherein at any occurrence of a signal that the local clock should be delayed the counter counter_minus is increased or the amount of the correction signal is added if the correction signal is larger than one bit and at any occurrence of a signal that the local clock should be brought forward the counter counter_plus is increased or the amount of the correction signal is added if the correction signal is larger than one bit.

6. Method according to claim 5, wherein the calculation is carried out by common redundant algorithms.

7. Method according to one of the previous claims, wherein the calculation of the correction value is derived through a comparison of the values of counter_plus and counter_minus, wherein the cycle start is delayed if counter_minus is larger and the cycle start is brought forward if counter_plus is larger.

8. Method according to one of the previous claims, wherein the value list is set to zero at the beginning of a cycle.

9. Method according to one of the previous claims, wherein multiple frames of a single communication node in a cycle are only evaluated once.

10. Method according to one of the previous claims, wherein only some frames are evaluated according to predetermined restrictions.

11. Method according to one of the previous claims, wherein the location of the correction information is in the payload of a frame.

12. Method according to one of the previous claims, wherein the location of the correction information is in the network management vector.

(FlexRay)

13. Method according to one of the previous claims, wherein the time deviation being determined by measuring the difference between the local time of the local clock and the external time of the clock source of increased accuracy,

14. Method according to one of the previous claims, wherein the external clock is another communication system connected to at least one of the preferred communication nodes.

15. Method according to one of the claims 1 to 14, wherein the external clock is an atomic clock, in particular provided in a satellite of the global-positioning system.

16. Method according to one of the previous claims, wherein a correction of the length of the cycle is done by the same procedure.

17. Computer program product stored on a computer usable medium comprising computer readable program means for causing a computer to perform the method of anyone of the claims 1 to 17, when said computer program product is executed on a computer.

18. Communication system (11) using distributed clock synchronization for performing the method according to one of the previous claims, characterized by that there are a plurality of communication nodes (7, 8), which are connected via at least one channel (5, 6), wherein at least one preferred communication node (8) among the communication nodes has a connection (9) to an external clock source (10) of increased accuracy, and that there are means provided to compare the locally provided clock with the clock source of increased accuracy.