ITUB20155561A1 - METHOD AND APPARATUS FOR A RESILIENT TIME SIGNAL - Google Patents

Description

METHOD AND APPARATUS FOR RESILIENT TIME SIGNALING.

Technical field

The present invention relates to a method for resilient time signaling and for resiliently maintaining time within distributed "real time" systems by generating time synchronization messages.

Time management is of fundamental importance in many areas of technology, for example:

a) in telecommunications, where the terminals or nodes of the network have stringent constraints of time synchronization error with respect to the backhaul time for communication purposes (for example the LTE-A standard, acronym of the English Long Term Evolution Advanced, requires synchronization less than 500 ns);

b) in electronics, for the synchronization of digital circuits of digital devices;

c) in smart grids or smart grids, where time synchronization is required by the synchronized phasor measurement systems, Phasor Measurement Unit (PMU) or synchrophasor, for distributed synchronized measurements to prevent cascade failures in the network;

d) in distributed control technologies, in which many actuators must have their respective dedicated synchronized control card in order to perform their tasks in real time in very limited time spans, State of the art

A precise and reliable indication of the time is of fundamental importance in many fields of the art and it is equally important to keep the local time indicated by a clock within a system in synchrony with a reference time signal.

In particular, in distributed systems it is essential to ensure the temporal synchronization of the various nodes or users making up the network.

The universal reference time (UT) is based on the Earth's rotation and the international standard on which civil time is based is the so-called U.T.C. (English acronym for "Universal Time Coordinaied").

In information management and exchange systems, it is important to establish precisely the order in which the various events occur and / or certain operations must be performed.

In a distributed system, establishing this order is complex due to the heterogeneity due to the difference in both software and hardware, as well as due to the different types of connections used by each node and due to the high dynamism that characterizes distributed systems, in which nodes or groups of nodes can enter or exit at any time.

In centralized systems, communications between the various ongoing processes take place exclusively through the exchange of messages; time synchronization requirements must therefore be met in order to determine which event was generated before another.

When the processes are in real time, i.e. when the response time problem is preponderant with respect to the complexity of the algorithm to be used, it is necessary to be able to react to a given event in a time that can be predetermined regardless of the context in which one is operating. .

However, it is impossible that all the clocks of the various nodes of the system are perfectly synchronized and this makes it impossible to order, in a precise and univocal way, all the events that occur within the system.

The lack of synchronization is due to the structural differences, mostly electronic, of the various devices for the generation of the time signal (or clock signal) inside the microprocessors or also to physical parameters such as temperature, state of use or The age of the device.

For all these reasons, there is a strong need to obtain a safe and reliable clock that can also act as a "master clock" within a network of distributed systems, providing the reference time to all the nodes of the network to which it is connected. .

The term "master clock" refers to an accurate and reliable clock that provides the time signal for synchronizing the clocks of the various users of a distributed network.

In the United States patent application in US 2014/0185632 A1 a structure of interconnected apparatuses and with at least two nodes is described in which a local master clock is implemented for periodic synchronization of the network nodes even in the event of a malfunction of one of the masters clock.

A sufficiently reliable and accurate master clock must be able to provide a very precise indication of the reference time, however, the oscillation frequency of any clock; physical is not always constant and tends to vary, mainly due to the tolerances of the values of the components used in the oscillator circuit and due to changes in the working conditions (temperature, aging of the components, sudden movements). For this reason, in modern applications, the universal reference time is obtained from an external source, typically a satellite signal, for example the signal provided by the GPS (Global Positioning System) system or that of the Galileo system or the GLONASS system (Global Navigation Satellite System).

The master clock must therefore first be synchronized with said external reference time.

In the United States patent IJS 8922421 B1 a method of synchronization of a distributed radar network is described by means of the time signal provided by the GPS satellite network.

However, when the signal is noisy and / or not reliable enough, a safe and accurate time source cannot be guaranteed.

In the United States patent US 9130661 B2 a method and an apparatus for the synchronization of distributed systems by means of a satellite time signal, after verification of its reliability and safety, is described.

In this case, the satellite time indication is used to generate the synchronization message and to synchronize the local reference clock; when the satellite signal is absent or unreliable, the synchronization message is generated on the basis of the time indication of said reference clock. Furthermore, a monitor measures the time interval between two successive synchronization messages and if this interval exceeds a predetermined tolerance, it prevents the synchronization of the network users.

The system described in US 9130661 B2, however, is not able to regulate its own local clock in such a way as to take into account the variability of the clock frequency and the operating environmental conditions.

Consequently, in the event of outages of the satellite network or in the absence of a GPS signal, the system will provide a time that is not sufficiently reliable, since it is based only on the signal supplied by the local reference clock.

To overcome this problem, methods have been devised that allow the synchronization of system clocks when the external satellite signal is not available, using special mathematical models.

Such a technical solution is described for example in US patent 8884706 B2, where one or more mathematical models are iteratively instructed and tested, in order to evaluate their degree of reliability and to select the most reliable model in the absence of an external synchronization signal.

However, even this solution does not allow taking into account the influence of environmental physical conditions on the drift of the local clock with respect to universal time. In US 2015/0025831 A1 a seismic detection network is described in which the local clocks of the various network nodes are periodically synchronized with the GPS signal and the ambient temperature is measured and used to determine the update rate of the local clock. In this case, therefore, the temperature measurement is not used to calculate the drift of the local clocks, but for the sole purpose of reducing the number of synchronizations to save energy.

It is known that the distance of the local clock with respect to the reference time, also called "offset", is not easily predictable as it varies continuously according to the environmental conditions and the characteristics of the local clock itself.

The offset at a given instant of time is very difficult to calculate, mainly due to the transmission delay between the reference time source and the receiving device. The synchronization uncertainty is defined as a conservative estimate of this offset.

Although various technical solutions have been developed, no resilient synchronization methods are known that allow to "correct" the local clock, according to any variations in temperature, humidity, pressure and other physical quantities, or after sudden movements, in the absence of an external synchronization signal for example the satellite one.

Furthermore, none of the methods and apparatuses described up to now allows to evaluate the degree of uncertainty of the time marked by the local clock, so as to provide a qualitative and quantitative measure of the time indicated by the local clock in the absence of external synchronization.

Modern synchronization protocols calculate an estimated offset without however offering guarantees on its actual proximity to the actual offset and without providing a threshold beyond which the system must no longer consider the time signal provided by the local clock to be more reliable.

Aims and summary of the invention

The invention which is the subject of the present patent application allows to overcome the drawbacks and limitations present in the state of the art, providing a method for resilient time signaling and for time synchronization within distributed systems, such as example user networks.

Resilience is achieved through a plurality of architectural attributes:

- availability and reliability, i.e. rapidity and continuity of the correct service;

- security, i.e. the absence of unauthorized access to the state of the system or its management;

- maintainability, i.e. the ability to undergo modifications and repairs;

- intrinsic safety, ie the ability to pass to a safe state in the event of an error exceeding a certain tolerance.

Time synchronization is the process by which the precision, accuracy, and drift properties of a system's local clock are maintained with respect to universal time provided by an external source.

According to the method object of the present patent application, the "external" reference time is that obtained from a satellite signal sent by one of the available satellite networks, for example the GPS, Galileo or GLONASS network or other similar networks.

The satellite signal is received by a plurality of dedicated satellite modules, equipped with a suitable antenna, which interpret said satellite signal by obtaining the time signal, for example in the form of an IPPs signal (one pulse per second).

The satellite signal is analyzed to detect possible anomalies such as "spoofing" or "jamming" in order to be able to apply appropriate countermeasures to guarantee the security of the system against external attacks.

The reception of the external temporal signal by a plurality of satellite modules ensures the continuity of execution of the method even when one or more satellite modules are disconnected for modifications or maintenance, thereby guaranteeing the availability and reliability of the method.

The external time signal received is used to control a clock, after estimating the offset and drift of the time signaled by said local clock with respect to universal time.

At the same time, the measurement of a series of physical quantities (for example temperature, pressure, humidity, etc.) is carried out by means of a plurality of dedicated measurement sensors.

The local time offset and drift values estimated with respect to universal time are stored and correlated to the physical quantities measured at the same instant by the dedicated sensors.

Local clock synchronization is essentially done by applying a correction coefficient to the local clock time signal to synchronize it to universal time.

In conditions of normal presence of a satellite signal, the local clock is synchronized by calculating, by means of suitable algorithms, the offset and the drift with respect to the universal time provided by the satellite network.

On the other hand, when the satellite signal is absent or not validated by the system, the synchronization of the local clock takes place using suitable mathematical models to calculate the offset and drift with respect to universal time as a function of the environmental conditions present, measured by dedicated sensors.

This mathematical model can possibly be built on a base of historical offset and drift data and corresponding physical quantities so that the mathematical model returns the most appropriate offset and drift values for the environmental conditions present.

Very advantageously, the mathematical model can be an automatic learning algorithm, capable of improving its performance automatically as the series of data available to it increases over time.

1 / offset and the local time drift are analyzed and the degree of uncertainty of the local time is thus evaluated, so as to be able to obtain a measure of its reliability, making, if necessary, further synchronization attempts when said uncertainty exceeds certain pre-established limits.

The method can be advantageously used for the time synchronization of a plurality of nodes of a distributed network: in this case, after said local clock has been synchronized to universal time and the local time uncertainty has been estimated, an iterative process is started. which periodically generates and sends a time synchronization message to the users of the network, to synchronize the clocks of the individual nodes with the local clock.

This iterative process of generating and sending a synchronization message can advantageously be started or kept active only when the estimated uncertainty is lower than a predetermined threshold value. Where, on the other hand, said uncertainty is higher than the predetermined threshold value, said iterative process is terminated and, if necessary, a new synchronization attempt is made,

The intrinsic safety of the method is guaranteed by the fact that the generation and sending of this synchronization message does not occur when, for any reason (for example network problems, hardware problems, etc.) the uncertainty is too high.

For the purpose of energy saving, the satellite signal reception modules can be deactivated when the estimated uncertainty is below a certain threshold and reactivated when the uncertainty exceeds this threshold.

The present patent application also relates to an apparatus for resilient weather signaling and suitable for carrying out the method described above, said apparatus substantially comprises:

- an oscillator comprising dedicated circuitry and a resonator to provide a reference frequency for the other electronic components of the apparatus;

- an electronic processor capable of executing all the processes and programs for the implementation of the method;

- a physical controller I / O (input / output) which allows the computer to be connected to external devices such as sensors or other devices;

- a plurality of sensors for measuring physical quantities (temperature, humidity, pressure, etc.);

- a plurality of satellite receiver modules.

In the case of applications to network systems, the apparatus further comprises a plurality of network cards (NICs) which allow the sending of time synchronization messages to the nodes of a distributed network.

The electronic processor periodically performs functional or structural hardware tests and checks on any software module in execution to realize the safety attributes and possibly interrupt the execution of the method if an anomaly is detected.

The plurality of satellite receiver modules and NIC network cards are configured to tolerate multiple failures or disconnections or shutdowns, thereby realizing the system availability and reliability attribute.

The time synchronization messages are transmitted according to a network time protocol, for example, the IEEE Standard 1588-2008 (Precision Time Protocol v2, PTPv2) or the RFC 5905 protocol (Network Time Protocol Version 4, NTPv4), or also any other compatible or future version.

Brief description of the drawings

Fig. 1 shows a functional flow diagram of the steps of the method object of the present patent application in accordance with a possible embodiment comprising the steps of:

- reception of a satellite signal (a);

- analysis and eventual validation of said signal (b);

- measurement and storage of physical quantities (C);

interpretation of the satellite signal and calculation of offset and drift of a local clock (d);

- calculation of offset and drift of a local clock using a mathematical model based on the physical quantities measured (e);

- local clock time correction (f);

- estimate of the local time synchronization uncertainty (g);

- repetition of the previous phases (h).

Fig. 2 shows a flow diagram of a possible embodiment of the method in which step (c) is performed only if the satellite signal analyzed in step (b) is invalid.

Fig. 3 shows a flow chart of a possible embodiment of the method in which if the uncertainty estimated in step (g) is equal to or less than a threshold value, in the next iteration of the method the steps ( a), (b) and (d).

Fig. 4 shows a flow chart of a possible embodiment of the method in which, after step (g), if the estimated uncertainty is equal to or less than a predetermined value, it starts or remains active (z) an iterative process of generation and sending of a time synchronization message to the users of a network, while if this estimated uncertainty is higher than said predetermined value, said iterative process of generation and sending of said time synchronization message is terminated (x) .

Detailed description of an embodiment of the invention

The following detailed description, carried out purely by way of non-limiting example, with reference to the attached drawings, highlights the further characteristics and advantages deriving from them and which are an integral part of the invention in question.

The present invention provides a method for resiliently reporting time by providing information on its accuracy with respect to universal time.

The universal time signal is obtained from a reliable external source such as the satellite signal received by a constellation of satellites, for example the satellites of the GPS, Galileo, GLONASS or other similar networks.

According to a preferred embodiment, the method provides the steps described below.

In the first place there is phase (a) of receiving a satellite signal, said signal containing an indication of the universal time based on the Earth's rotation, according to a specific international standard. A very high precision can be achieved by exploiting dedicated synchronization signals provided by the satellite module such as, for example, the 1PPS signal (one pulse per second). Subsequently, in phase (b), said satellite signal is analyzed to verify that it is safe and reliable and to detect any anomalies, for example data manipulation ("spoofing") or radio communications disturbances ("jamming"), an indication of possible attacks external. In the absence of anomalies and disturbances, the signal is validated. In the following step (c), through a plurality of dedicated sensors, a series of physical quantities indicative of the existing environmental conditions are measured. The physical quantities of interest are those which can influence the oscillation of the local clock crystal, for example temperature, pressure, humidity, sudden movements and / or displacements. The physical quantities from the various sensors measured are stored.

If the satellite signal analyzed in the previous phase (b) is valid, one proceeds to phase (d), in which said signal is interpreted to extrapolate the time indication of the universal time signal and is thus estimated, by means of specific algorithms, the drift and the offset of the time reported by a local clock with respect to said universal time.

If, on the other hand, the satellite signal analyzed in step (b) is not valid, step (e) is performed: the offset and drift of the local clock with respect to universal time are calculated using a mathematical model, depending on the environmental conditions present. , defined by the physical quantities measured in the previous point (c).

In the following phase (f) one proceeds to suitably "correct" the time indication of the local clock, on the basis of the estimated offset and drift, so as to synchronize it to universal time. The synchronization of the local clock occurs by gradually changing the reference time of the local clock itself, making it run faster or slower, until the required correction is reached.

The synchronization of the local clock can take place by means of a PTP or NTP synchronization signal or other similar protocols. In some embodiments of the method, the synchronization message for the nodes of a distributed network conforms to the NTPv4 or PTPv2 standards. Finally, in phase (g), by means of statistical and probabilistic analyzes (for example the Fokker-Planck equation or the Bayes theorem), the local clock time synchronization uncertainty is estimated.

The method described above can advantageously be carried out periodically, in an iterative manner.

In a possible version of the method, a new iteration of the procedure is carried out only when the uncertainty estimated in step (g) is higher than a certain pre-selected threshold value (si).

According to an advanced version of the method for the resilient signaling of time object of the present patent application, the mathematical model used in step (e) is built on a historical data base of values of measured physical quantities and of corresponding values of offset and drift of the local clock with respect to universal time. Very advantageously, the mathematical model used in phase (e) can be an automatic learning algorithm, capable of automatically improving its own "performances" on the basis of the acquired experience.

In a possible version of the method in question, step (c) is performed only when the satellite signal analyzed in the previous step (b) is not valid, in this way avoiding having to activate the measurement sensors when it is not strictly necessary, mainly for energy saving purposes.

According to a further version of the method object of the present application, when the uncertainty estimated in step (g) is equal to or less than a threshold value (s2), in the subsequent iteration of the method, steps (a) (b) are not carried out. (d), in this way avoiding having to activate the satellite reception modules.

In a possible variant of the method in question, particularly suitable for being applied to distributed networks, after step (g), an iterative process can be started which periodically generates and sends a time synchronization message to the users of the network, to synchronize the single node clocks at the time indicated by the local clock.

This iterative process is started or, if it already is, it is simply kept active (z), only when the estimated uncertainty is equal to or less than a predetermined value (s3); when, on the other hand, said uncertainty is higher than this threshold value (s3), the iterative process is terminated (x) and is reactivated only when the uncertainty returns to be lower than the predetermined value (s3).

The present patent application also relates to an apparatus for resilient weather signaling capable of implementing the method described above.

According to a possible embodiment, this apparatus comprises:

- an oscillator substantially constituted by a circuitry and a resonator adapted to provide a reference frequency for the other electronic components of the apparatus;

- an electronic processor capable of executing all the processes and programs for the implementation of the method;

- a physical controller I / O (input / output) to connect the processor to external devices such as sensors or other devices;

- one or more sensors for measuring physical quantities (temperature, humidity, pressure sensors, gyroscopes, accelerometers, etc.);

- one or more satellite receiver modules.

In a particularly advanced embodiment and suitable for use as a master clock within networks, this apparatus further comprises one or more network cards for sending time synchronization messages to the nodes of the distributed network.

Advantageously, said one or more network cards can conform to the IEEE 1588 PTP standard to provide a hardware time stamp so as to improve the synchronization accuracy of the network nodes.

In the case of a plurality of satellite receiving modules, the apparatus is able to function correctly even in the event that one or more modules stop functioning or are deactivated for maintenance.

Similarly, it is possible to provide for the implementation of several sensors of the same type for measuring each of the physical quantities of interest, for example by providing a plurality of temperature sensors and / or a plurality of pressure sensors, etc. etc., in such a way that the apparatus can operate normally even in the event of malfunctions or deactivations of one or more of said sensors.

Similarly, in the case of a plurality of network cards, the system is able to continue to function even when one or more cards are disabled or not functioning.

Claims (9)

CLAIMS 1. Method for resilient weather reporting characterized by including the following steps: (a) receive a satellite signal containing a universal time indication; (b) analyze the satellite signal and validate it in the absence of anomalies or disturbances in the signal itself; (c) measuring and storing a plurality of physical quantities representative of the existing environmental conditions; (d) if the satellite signal is valid, interpret the satellite signal to obtain the indication of the universal time and calculate, by means of suitable algorithms, an estimate of the offset and the drift of the time signaled by a local clock with respect to said universal time; (e) if the satellite signal is invalid, use a mathematical model to calculate an estimate of the offset and drift of the local time with respect to universal time as a function of the present environmental conditions, measured in step (c); (f) correcting the local clock time based on the estimated offset and drift; (g) estimating the local clock time synchronization uncertainty; (h) repeat steps (a) and following. 2. Method for resilient time signaling as per the preceding claim characterized by the fact that the mathematical model used in step (e) is built on a local clock offset and drift database corresponding to physical quantities representative of certain conditions environmental. 3. Method for resilient time signaling as per one or more of the preceding claims characterized in that the mathematical model used in step (e) is an automatic learning algorithm. 4. Method for resilient weather signaling as per one or more of the preceding claims characterized in that step (c) is performed only if the satellite signal analyzed in step (b) is not valid. 5. Method for resilient reporting of time as per one or more of the preceding claims characterized by the fact that if the uncertainty estimated in step (g) is equal to or less than a threshold value (s2), in the subsequent iteration of the method steps (a), (b) and (d) are not performed. 6. Method for resilient reporting of time as per one or more of the preceding claims characterized in that after step (g), if the estimated uncertainty is equal to or less than a predetermined value (s3), it starts or it keeps active (z) an iterative process of generation and sending of a time synchronization message to the users of a network. 7. Method for resilient time signaling as per the preceding claim characterized in that after step (g), if the estimated uncertainty is greater than a predetermined value (s3), (x) said iterative generation process is terminated and sending said time synchronization message. 8. Apparatus for resilient time signaling in implementation of the method as per one or more of the preceding claims, characterized in that it comprises: - an oscillator comprising a dedicated circuitry and a resonator to provide a reference frequency for the other components of the apparatus; - an electronic processor capable of executing all the processes and programs for the implementation of the method; - a physical controller I / O (input / output) to connect the processor to external devices such as sensors or other apparatuses; - one or more sensors for measuring physical quantities; - one or more satellite receiver modules. 9. An apparatus as per the preceding claim characterized in that it comprises one or more network cards for sending time synchronization messages to the nodes of a distributed network.