Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L12/00—Data switching networks
  • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
  • H04L12/42—Loop networks
  • H04L12/437—Ring fault isolation or reconfiguration
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
  • H04L69/40—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection

Definitions

• the present invention relates in general to the architecture for fault- tolerant time-triggered communication systems.
• the present invention in particular relates to a method for operating a distributed communication system, in particular for synchronizing clocks in such distributed communication system, with a number of nodes being interconnected by at
• 10 least one communication link comprising at least two channels.
• the present invention further relates to a node of a distributed communication system with a number of nodes being interconnected by at least one communication link comprising at least two channels.
• This network comprises two channels Cl, C2 to which respective nodes N are connected.
• Each of these nodes N comprises bus drivers Bl, B2, a communication controller CC with a protocol engine P and a controller host interface CI, optionally a bus guardian device for each bus driver Bl, B2 and the application host H.
• the bus driver B 1 , B2 transmits the bits and bytes, which are provided by the communication controller CC, onto its connected channel Cl, C2 and in turn provides the communication controller CC with the information received on the channel Cl, C2.
• the communication controller CC is connected to both channels Cl, C2 via its bus drivers Bl, B2, delivers relevant data to the host application H, and receives data
• the bus driver Bl, B2, the (optional) bus guardian and the host device H are at least partially time-triggered, meaning that the time is sliced into recurring cycles where each cycle comprises several segments.
• Each node N determines the start of a
• At least one segment is divided into a fixed number of slots where each slot is assigned up to at most one communication controller CC wherein that communication controller and alone that communication controller CC has the right to transmit.
• Other segments of the cycle can be used for dynamic arbitration schemes or for other purposes.
• the bus guardian is a device with an independent set of configuration data that enables the transmission on the bus only during those slots which are specified by the configuration set.
• the host application H contains the data source as well as data sink and is generally not concerned with the protocol activity. Only decisions that the communication controller CC cannot do alone are made by the host application H.
• the nodes N have to be synchronized to each other because each node N derives on its own the start of the cycle and thereby the placement of all segments and slots in time.
• Each node N has an own clock in order to not be dependent on a single master clock whose failure would collapse the whole system.
• the difference between its own clock and the clocks of some subset of nodes of the system, which are called synchronization nodes (or sync nodes), is used to correct its own clock in a fault- tolerant way.
• the offset correction only corrects the clock offset whereas the rate correction also tries to align the different rates of the clocks in the system, thereby keeping the clocks closer to each other (reducing the amount of offset correction necessary, thereby increasing the available bandwidth due to decreased inter transmission gaps).
• the clocks are corrected at the end of a cycle, or at the end of two cycles in case of rate and offset correction because two measurement values are necessary to calculate a rate deviation.
• Prior art document EP 1 355 459 A2 refers to a method for synchronizing clocks in a distributed communication system comprising at least one communication media and a number of nodes connected to the communication media; the nodes comprise the clocks.
• the nodes comprise the clocks.
• prior art document JP 2003-195903 discloses a duplicated communication module device; however, this prior art document does not refer to the fault-tolerant distributed synchronization of a duplicated system.
• an object of the present invention is to maintain access of the application host to at least one of the channels attached to the communication controller in case this communication controller fails or breaks down.
• the object of the present invention is achieved by a method comprising the features of claim 1 as well as by a node comprising the features of claim 5.
• the gist of the present invention refers to the concept of combining a dual-channel clock synchronization with a single-channel based architecture for fault- tolerant time-triggered communication systems.
• the communication controllers of each channel preferably employ some kind of fault-tolerant clock correction mechanism among each other applying correction to both the offset and the rate.
• the single-channel communication controller By dividing the single-channel communication controller into two (nearly) independent entities, two different fault-domains are provided; so if one of the new communication controllers has a fault, the other one continues to work. But this mechanism can only work together with the conventional dual-channel communication controllers if the combined behaviour of the two single-channel communication controllers does not deviate too much from the behaviour of a dual-channel communication controller. Especially the clocks of both communication controllers should be closely aligned (, which is given for a dual-channel communication controller because a dual-channel communication controller comprises only one clock anyway).
• the mechanism proposed by the present invention keeps already closely aligned channels closely aligned while it not necessarily synchronizes channels that deviate from each other by for instance half a cycle length or more.
• the communication controllers of each channel preferably employ some kind of fault-tolerant clock correction mechanism among each other.
• each single-channel communication controller closely follows the timing difference between itself and its attached single- channel communication controller of the opposite channel.
• a first option of achieving this is via at least one dedicated interface by which the two single-channel communication controllers mutually measure the time of the respectively other single-channel communication controller in relation to the respectively own time.
• This can be advantageously employed via at least one dedicated signal line which signals the local cycle start to the other single channel communication controller.
• the attached single-channel communication controller can calculate the clock offset from the difference between the expected signal and the actual signal. Via this signal, the offset as well as the rate difference between the two single-channel communication controllers can be calculated.
• Another option is to directly exchange a numerical value incorporating more information regarding the local clock and the channel.
• the two associated single-channel communication controllers now know the clock difference they have to each other.
• AU single-channel communication controllers know the clock difference to their local counter-part. They all calculate in an identical way an additional, signed inter-channel correction.
• the present invention further relates to a computer program being able to run on at least one computer, in particular on at least one microprocessor, and being programmed in order to execute a method as described above.
• the computer program can be stored on at least one R[ead]O[nly]M[emory], on at leastone R[andom]A[ccess]M[emory] or on at least one flash memory.
• the present invention further relates to a distributed communication system with a number of nodes as described above, wherein said communication system is fault-tolerant and/or time-triggered.
• the present invention finally relates to the use of the method as described above and/or of at least one computer program as described above and/or of at least one node as described above and/or of the communication system as described above for synchronizing clocks in a at least dual-channel environment wherein differences in offset of the clocks as well as differences in rate of the clocks can be corrected
• the presented mechanisms enable a scalable architecture concept based on single-channel communication units. Thereby, this concept allows building system architectures with different levels of fault tolerance. Furthermore, it provides all freedom for product decisions.
• the same functional unit can be implemented as a single-channel I[ntegrated]C[ircuit] or, without any functional changes, can be combined to a redundant dual-channel I[ntegrated]C[ircuit].
• the concept according to the present invention even supports product options that allow for using the two communication controllers of a chip to participate in different communication clusters. For such application, the inter-channel interface is simply disabled. Each communication unit is fully functional to operate as a single unit in a cluster on its own.
• Fig 1 schematically shows a network system according to the prior art
• Fig. 2A schematically shows a first embodiment of a fault-tolerant time- triggered network system according to the present invention which works according to the method of the present invention
• Fig. 2B schematically shows a second embodiment of a fault-tolerant time-triggered network system according to the present invention which works according to the method of the present invention
• Fig. 2C schematically shows a third embodiment of a fault-tolerant time- triggered network system according to the present invention which works according to the method of the present invention
• Fig. 3 A schematically shows a diagram of the clock information exchange between the two single-channel comunication controllers according to the present invention where the measurement of their offset as well as the change of the cycle length are illustrated as a function of the time t;
• Fig. 3B schematically shows a diagram of the clock information exchange between the two single-channel comunication controllers according to the present invention where the measurement of their offset and of their rate differences as well as the change of the cycle length are illustrated as a function of the time t.
• the same reference numerals are used for corresponding parts in Fig. 2A to Fig. 3B.
• the present invention describes a distributed communication system as well as a method for having independent clock synchronization and clock correction for each ⁇ communication controller 30, 32 (cf. Figure 2A, Figure 2B and Figure 2C, where the respective schematic - of a first embodiment of a node 100, of a second embodiment of a node 100', and of a third embodiment of a node 100" is shown).
• the fault-tolerant time-triggered system comprises two channels 10, 20 to which respective nodes are connected.
• Each of these nodes comprises a respective bus driver 12, 22, a respective communication controller 30, 32 with the respective protocol engine 50, 52 and a respective controller host interface 40, 42, optionally a respective bus guardian device for each bus driver 12, 22 and the application host 60.
• the respective bus driver 12, 22 transmits the bits and bytes, which are provided by the respective communication controller 30, 32, onto its respective connected channel 10, 20 and in turn provides the respective communication controller 30, 32 with the respective information received on the respective channel 10, 20.
• the respective communication controller 30, 32 is connected to the respective channel 10, 20 via its respective bus driver 12, 22, delivers relevant data to the host application 60, and receives data from the host application 60 which in turn assembles the data to frames and delivers the data to the respective bus driver 12, 22.
• the respective bus driver 12, 22, the (optional) bus guardian and the host device 60 are at least partially time-triggered, meaning that the time is sliced into recurring cycles where each cycle comprises several segments.
• Each node determines the start of a new cycle according to its own built-in clock.
• At least one segment is divided into a fixed number of slots where each slot is assigned up to at most one respective communication controller 30, 32 wherein that respective communication controller 30, 32 and alone that respective communication controller 30, 32 has the right to transmit.
• Other segments of the cycle can be used for dynamic arbitration schemes or for other purposes.
• the bus guardian is a device with an independent set of configuration data that enables the transmission on the bus only during those slots which are specified by the configuration set.
• the host application 60 contains the data source as well as data sink and is generally not concerned with the protocol activity. Only decisions that the respective communication controller 30, 32 cannot do alone are made by the host application 60.
• the redundant communication channel can be based on the single-channel architecture using two separated instances 30, 32 (cf. Figure 2B) or an on-chip implementation within a single unit (cf. Figure 2C).
• the local intra-channel communication interface is a chip-external interface 54 (cf. Figure 2B) or an on-chip interface 56 (cf. Figure 2C), respectively.
• the nodes have to be synchronized to each other because each node derives on its own the start of the cycle and thereby the placement of all segments and slots in time.
• Each node has an own clock in order to not be dependent on a single master clock whose failure would collapse the whole system.
• the difference between its own clock and the clocks of some subset of nodes of the system, which are called synchronization nodes (or sync nodes), is used to correct its own clock in a fault- tolerant way.
• the offset correction only corrects the clock offset whereas the rate correction also tries to align the different rates of the clocks in the system, thereby keeping the clocks closer to each other (reducing the amount of offset correction necessary, thereby increasing the available bandwidth due to decreased inter transmission gaps).
• the clocks are corrected at the end of a cycle, or at the end of two cycles in case of rate and offset correction because two measurement values are necessary to calculate a rate deviation.
• All synchronization nodes have to transmit synchronization frames during one of their assigned slots on both channels 10, 20 at the same time; so all nodes receive the same time information, also nodes connected to only one channel.
• each communication controller 30, 32 closely follows the timing difference between itself and its attached single-channel communication controller of the opposite channel; in particular, each single-channel communication controller 30, 32 measures each others time in relation to its own time, calculates offset and rate difference by two possible methods, and the fault-tolerant parameters are calculated using the method provided for both rate and offset corrections, for instance by direct exchange of a numerical value incorporating more information regarding the local clock and the channel.
• Be a, b e R + the damping factors, a for intra-channel clock correction and b for inter-channel clock correction, a and h may be chosen separately for offset correction and rate correction (for simplification, this is not reflected in the following formulas).
• Tj(t) the real time of the cycle time t of communication controller i e C.
• T,(0) is the real time of when communication controller i thinks cycle one shall start
• Tj(z) is the real time of when communication controller i thinks cycle one ends and cycle two starts and so on.
• Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of an incoming synchronization) frame with the expected arrival time.
• FT is a fault-tolerant offset calculation algorithm. Examples for such algorithms can be found in Fred B. Schneider, "Understanding Protocols for Byzantine Clock Synchronization", Cornell University, Ithaca, New York, August 1987. The preferred variant is the F[ault-]T[olerant]M[idpoint] algorithm. All nodes i e B s do likewise.
• Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of an incoming sync(hronization) frame with the expected arrival time.
• All nodes i e B s do likewise. It depends on the system configuration, when within one cycle the offset measurement between a certain pair of communication controller is taken, so it is represented by x hJ .
• M 1 ⁇ is the difference in offset between communication controller i and communication controller/ within cycle one after the last correction measured in the local time of communication controller i flawed by the measurement error ⁇ .
• Ad 1 , j is the difference in offset between communication controller i and communication controller/ within cycle two after the last correction measured in the local time of communication controller i flawed by the measurement error ⁇ .
• FT is a fault-tolerant offset calculation algorithm. Examples for such algorithms can be found in Fred B. Schneider, "Understanding Protocols for Byzantine Clock Synchronization", Cornell University, Ithaca, New York, August 1987.
• the preferred variant is the F[ault-]T[olerant]M[idpoint] algorithm. All nodes i e B 8 do likewise.
• the rate correction term for communication controller i is calculated by
• FT is a fault-tolerant offset calculation algorithm. Examples for such algorithms can be found in Fred B. Schneider, "Understanding Protocols for Byzantine Clock Synchronization", Georgia University, Ithaca, New York, August
• the preferred variant is the F[ault-]T[olerant]M[idpoint] algorithm. All nodes i e B s do likewise.
• the FTM can tolerate up to k Byzantine failures if more than 2&+1 measurements are given.
• the FTM algorithm sorts the passed values and removes the k lowest values and the k highest values. It then chooses the remaining highest value and the remaining lowest value and calculates the average of both.
• the measured value of the offset difference of node L 1 is the lowest one and the measured value of the offset difference of node H, is the highest one.
• Figure 3 A and Figure 3B show examples of how the measurement between the two associated communication controllers 30, 32 is performed for the simple way:
• Figure 3A shows how the single-channel communication controller 30 of the first channel 10 and the single-channel communication controller 32 of the second channel 20 can exchange their clock information via one signal each.
• the two communication controllers 30, 32 measure their offset and change the length of the cycle c to compensate it (— > cycle boundaries bw with correction compared to cycle boundaries bo without correction; the difference between bw and bo is the correct offset co).
• a function f is used to make this mechanism fault-tolerant. If the propagation delay of the signal is known it can be compensated for additional accuracy.
• Figure 3B shows how the single-channel communication controller 30 of the first channel 10 and the single-channel communication controller 32 of the second channel 20 can exchange their clock information via one signal each.
• the two communication controllers 30, 32 measure their offset differences as well as rate differences and change the length of the cycle c to compensate it or them (--> cycle boundaries bw with correction compared to cycle boundaries bo without correction; the difference between bw and bo is the correct offset / correct rate cor).
• Functions f and g are used to make this mechanism fault-tolerant. If the propagation delay of the signal is known it can be compensated for additional accuracy. Concerning the properties, the above-described algorithm is quick and does not require a complex additional interface between two associated communication controllers 30, 32.
• a and b shall be configurable instead of being fixed to the optimal choice, for being compatible to a single channel system, wherein a choice of one is optimal (no additional term from the second channel 20 has to be incorporated).
• Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of an incoming sync(hronization) frame with the expected arrival time.
• Mi j is the difference in offset between communication controller i and communication controller/ within cycle one after the last correction measured in the local time of communication controller i flawed by the measurement error ⁇ .
• FT is a fault-tolerant offset calculation algorithm. Examples for such algorithms can be found in Fred B. Schneider, "Understanding Protocols for Byzantine Clock Synchronization", Cornell University, Ithaca, New York, August 1987.
• the preferred variant is the F[ault-]T[olerant]M[idpoint] algorithm. The same is done for all communication controllers i e B 3 :
• Each node i e A 8 now transmits its correction term ⁇ 5, offset to its associated communication controller s(i) and receives from the associated communication controller s(i) in turn ⁇ s ⁇ ° ffset .
• communication controller / can calculate its offset correction term
• Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of an incoming sync(hronization) frame with the expected arrival time. Be i e A 8 . Then for each observable communication controller/ e A s ,j ⁇ i, communication controller i measures each cycle the offset
• Ad 1 Ij is the difference in offset between communication controller i and communication controller/ within cycle one after the last correction measured in the local time of communication controller i flawed by the measurement error ⁇ .
• Ad 2 Jj is the difference in offset between communication controller i and communication controller y within cycle two after the last correction measured in the local time of communication controller i flawed by the measurement error ⁇ .
• FT is a fault-tolerant offset calculation algorithm. Examples for such algorithms can be found in Fred B. Schneider, "Understanding Protocols for Byzantine Clock Synchronization", Cornell University, Ithaca, New York, August 1987.
• the preferred variant is the F[ault-]T[olerant]M[idpoint] algorithm. The same is done for all communication controllers i e B s :
• Each node i e A 5 now transmits its correction terms d° met and ⁇ S, mte to its associated communication controller s( ⁇ ) and receives from the associated communication controller s( ⁇ ) in turn ⁇ s (,) ⁇ fset and ⁇ s (, TM te .
• communication controller i can calculate its offset correction term
• the FTM can tolerate up to k Byzantine failures if more than 2&+1 measurements are given.
• the FTM algorithm sorts the passed values and removes the k lowest values and the k highest values. It then chooses the remaining highest value and the remaining lowest value and calculates the average of both.
• both communication controllers 30, 32 are subject to an offset. Both communication controllers 30, 32 can only finish the calculation of their correction terms when the slowest one has done so. This can only work if both communication controllers 30, 32 differ only within bounds that have to be guaranteed by the system start-up, otherwise the clock synchronization cannot "kick in”. Once this condition is given, the clock synchronization algorithm can keep the associated controllers 30, 32 within these bounds.
• the present invention proposes a new way to synchronize the operation of two independent single-channel communication controllers 30, 32 - probably (cf. Figure 2C) but not necessarily (cf. Figure 2B) on the same chip - on different channels 10, 20 to virtually emulate the behaviour of a two-channel controller CC (cf. Figure 1), thereby enabling cost-effective Integrated] C[ircuit] blocks to be created that can be used to either generate either single-channel communication controllers or dual-channel communication controllers.
• the communication controller 30, 32 is of primary importance.
• the bus driver 12, 22, the bus guardian and the host device 60 are listed to provide a full technical concept in which context the present invention might be used.
• the present invention is not limited or restricted by the presence or absence of those devices.
• controller host interface in particular assigned to the second communication controller 32
• protocol engine in particular assigned to the second communication controller 32
• local intra-channel communication external interface in particular assigned to the second communication controller 32
• local intra-channel communication external interface in particular assigned to the second communication controller 32
• CC communication controller (prior art; cf. Figure 1)

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Synchronisation In Digital Transmission Systems (AREA)
• Hardware Redundancy (AREA)

Priority Applications (1)

Applications Claiming Priority (3)

Publications (1)

Family

ID=35431922

Family Applications (1)

Country Status (4)

Families Citing this family (3)

Family Cites Families (3)

• 2005
  • 2005-08-17 EP EP05774640A patent/EP1790132A1/de not_active Withdrawn
  • 2005-08-17 JP JP2007529072A patent/JP2008512021A/ja not_active Withdrawn
  • 2005-08-17 CN CN200580037430.XA patent/CN101053216A/zh active Pending
  • 2005-08-17 WO PCT/IB2005/052713 patent/WO2006024982A1/en active Application Filing

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events