JP2008512021A - Distributed communication system using two communication controllers and method of operating such a communication system - Google Patents

Abstract

  Especially for operating a distributed communication system in which several nodes (100, 100 ′, 100 ″) are interconnected by at least one communication link comprising at least two channels (10, 20) Application host (60) access to at least one of channels (10, 20) connected to a communication controller (30, 32) for synchronizing clocks in a distributed communication system In order that each channel (10, 20) can maintain its own communication controller (30, 32) in the event that the communication controller (30, 32) fails or breaks. ) Is proposed.

Description

  The present invention relates generally to architectures for fault tolerant time-triggered communication systems.

  The present invention specifically synchronizes clocks in such a distributed communication system, particularly for operating a distributed communication system in which several nodes are interconnected by at least one communication link including at least two channels. Related to the method.

  The invention further relates to a node of a distributed communication system in which several nodes are interconnected by at least one communication link comprising at least two channels.

  In FIG. 1, a typical fault tolerant time trigger network is shown in schematic form. This network includes two channels C1 and C2, to which a respective node N is connected. Each of these nodes N has a bus driver B1, B2, a communication controller CC with a protocol engine P and a controller host interface CI, optionally a bus guardian device for each bus driver B1, B2, and an application Includes host H.

  The bus drivers B1, B2 send the bits and bytes provided by the communication controller CC on their connection channels C1, C2, and in turn provide the information received on the channels C1, C2 to the communication controller CC. The communication controller CC is connected to both channels C1 and C2 via the bus drivers B1 and B2, delivers corresponding data to the host application H, receives data from the host application H, and the host application H , Assemble the data into frames and deliver the data to the bus drivers B1, B2.

  The bus drivers B1, B2, (optional) bus guardian, and host device H are at least partially time triggered, ie, the time is sliced into circular cycles where each cycle includes several segments. Each node N determines the start of a new cycle according to its own built-in clock.

  At least one segment is divided into a fixed number of slots, where each slot is assigned at most one communication controller CC, in which case only that communication controller CC is authorized to transmit. Other segments of the cycle can be used for dynamic arbitration schemes or other purposes.

  A bus guardian is a device with an independent set of configuration data that allows transmission on the bus only during the slot specified by the configuration set.

  Host application H includes a data source and a data sink and is generally not involved in protocol activity. Only the determination that the communication controller CC cannot make alone is made by the host application H.

  Nodes N need to be synchronized with each other because each node N gets its own start of the cycle, thereby getting the placement of all segments and slots in time. Each node N has its own clock so that its failure does not depend on a single master clock that will cause the entire system to fail. The difference between its own clock, called the synchronization node (or sink node), and the clock of some subset of the nodes of the system is used to correct its own clock in a fault tolerant manner.

Two types of clock correction, namely
Pure offset correction and a combination of offset correction and rate correction are possible.

  Offset correction simply corrects the clock offset, while rate correction also tries to match the different rates of the clocks in the system, thereby keeping the clocks closer to each other (the amount of offset correction required). Reduced, thereby increasing the available bandwidth since the mutual transmission gap is reduced). Since two measurements are required to calculate the rate deviation, for rate and offset correction, the clock is typically corrected at the end of one cycle or at the end of two cycles.

All sink (synchronization) nodes need to transmit synchronization frames simultaneously on both channels C1, C2 in one of their assigned slots. Accordingly, all nodes receive the same time information, and so does a node connected to only one channel. A system that matches the above
“Specification of the TTP / C protocol” (Draft 0.5), Herman Kopetz et al., TTTech Computertechnik AG, July 1999 (see http://www.tttech.com/), or R.C. Belschner et al., “FlexRay-Requirements Specification” (version 2.0.2), FlexRay Consortium, April 2002 (see http://www.flexray.com/).
Is disclosed. The corresponding prior art document WO 03/010611 A1 relates to the FlexRay protocol, in particular node subset, message reception, time and clock rate deviation measurement, offset correction value calculation and clock rate correction value calculation, and Clarifies clock synchronization in a distributed system in a FlexRay® automotive communication system with node clock adjustment.

  Prior art document EP 1 355 459 A2 refers to a method for synchronizing clocks in a distributed communication system comprising at least one communication medium and several nodes connected to the communication medium. However, those nodes contain their clocks. Clock offset and clock rate differences are corrected to synchronize the clocks to allow them to synchronize with high accuracy and at the same time allow for high deviations in clock rate. It has been proposed to be.

  In addition, JP 2003-195903, a prior art document, discloses a duplex communication module device. However, this prior art document does not mention fault-tolerant distributed synchronization of duplexed systems.

  Despite all of the above efforts, if a dual channel communication controller fails, access to that connection channel is both prevented, thereby disconnecting the communication controller's application host from communication. The problem remains. By having a single communication controller handle both channels, several single points of failure arise, for example, clock synchronization is only implemented and used once.

  Starting from the aforementioned drawbacks and disadvantages and in view of the prior art discussed, the object of the present invention is to provide application host access to at least one of the channels connected to the communication controller. It is to maintain even if the communication controller fails or breaks.

  The object of the invention is realized by a method comprising the features of claim 1 and a node comprising the features of claim 5. Advantageous embodiments and advantageous refinements of the invention are disclosed in the respective dependent claims.

  The gist of the present invention is the concept of combining dual channel clock synchronization with a single channel based architecture for fault tolerant time triggered communication systems. In this context, each channel's communication controller preferably uses some kind of inter-fault fault tolerant clock correction mechanism that applies corrections to both offset and rate.

  The single channel architecture according to the invention, ie the technique of separating the communication controller into two independent entities, allows each entity (= so-called single channel communication controller) to continue to work even if one fails. Have advantages. In other words, at least two single channel communication controllers communicate with each other in such a way that a failure of one single channel communication controller cannot interfere with further communication of the other single channel communication controller.

Furthermore, fundamentally different behavior should not be shown on the channel in order to allow the communication node to interact with the other, possibly conventional communication controller (while the interface to the application may be different) Will be understood by those skilled in the art. Such a solution is used,
It is also possible to provide two different chips, ie one communication controller for each channel, or
Two single channel communication controllers can also be integrated into a single chip to reduce the cost for a communication system that requires lower fault tolerance.

  In accordance with the preferred embodiment of the present invention, two different mechanisms of the single channel communication controller need to communicate, namely start-up and clock synchronization.

  Dividing the single channel communication controller into two (almost) independent entities results in two different failure areas. Therefore, if one of the new communication controllers fails, the other communication controller continues to work. However, this mechanism can only work with a conventional dual channel communication controller if the combined behavior of the two single channel communication controllers does not unduly deviate from the behavior of the dual channel communication controller. In particular, the clocks of both communication controllers should be well aligned (this is achieved with a dual channel communication controller because a dual channel communication controller contains only one clock anyway).

  The mechanism proposed by the present invention keeps already well aligned channels well aligned, while channels that are offset from each other are not necessarily synchronized, eg, channels that are offset from each other, eg, more than a half cycle length. . In conjunction with or independent of it, each channel's communication controller preferably uses some kind of mutual fault-tolerant clock correction mechanism.

  Thus, the present invention keeps the channel "synchronized as necessary", ie each single channel communication controller follows the timing difference between itself and its connected single channel communication controller in the opposite channel. Realize the concept of

  The first option to achieve this is by at least one dedicated interface, so that two single channel communication controllers can have their respective single channel communication controller time relative to their own time. Are measured mutually. This can advantageously be used by at least one dedicated signal line notifying the other single channel communication controller of the start of a local cycle.

  Depending on the clock synchronization algorithm applied, the signal just before the correction phase may give better results, but other times are possible. All that is necessary is for the connected single channel communication controller to know when the signal needs to be expected. Therefore, the connected single channel communication controller can calculate the clock offset from the difference between the expected signal and the actual signal. With this signal, the offset difference and rate difference of the two single channel communication controllers can be calculated.

  Another option is to directly exchange numbers that incorporate more information about the local clock and channel.

  Now the two related single channel communication controllers know the clock difference they have. All single channel communication controllers know the clock difference from their local counterpart. They all calculate additional signed interchannel corrections in the same way.

  The invention further relates to a computer program which can be executed on at least one computer, in particular on at least one microprocessor and which is programmed to carry out the method described above.

  According to a preferred embodiment of the present invention, the computer program is stored in at least one ROM [Read Only Memory], at least one RAM [Random Access Memory], or at least one flash memory. it can.

  The invention further relates to a distributed communication system with several nodes as described above, in which case the communication system is fault tolerant and / or time triggered.

  The present invention finally ends up with at least one computer program and / or at least one node of the foregoing method and / or for synchronizing clocks in at least a dual channel environment. And / or a use of the communication system as described above, wherein the clock offset difference and the clock rate difference can be corrected.

  Overall, the presented mechanism enables a scalable architectural concept based on a single channel communication unit. Thereby, this concept makes it possible to build a system architecture with various levels of fault tolerance. In addition, this concept makes product decisions completely free.

  The same functional unit can be implemented as a single channel IC [integrated circuit] or can be combined into a redundant dual channel IC [integrated circuit] without any functional changes. The concept according to the invention also supports product options that allow two communication controllers on one chip to participate in different communication clusters. In such applications, the channel-to-channel interface is simply disabled. Each communication unit functions sufficiently to operate independently as a single unit within the cluster.

  As already discussed above, there are several options for advantageously implementing and improving the teachings of the present invention. For this purpose, reference is made to the claims subordinate to claim 1, claim 3 and claim 5, respectively. Further improvements, features, and advantages of the present invention will be described in more detail below in the context of three preferred embodiments, taken as examples, and the accompanying drawings (see FIGS. 2A-3B).

  The same reference numbers are used for corresponding parts in FIGS. 2A-3B.

  In the conventional architecture (see FIG. 1), in order to save costs, a single communication controller CC is simply assigned to each node N to handle the two channels C1, C2 required for redundancy reasons. Nevertheless, this approach is prone to errors such that a single error in the communication controller CC disables bus access to both channels C1, C2 of this node N.

Previous communication controllers CC according to the prior art have a single clock synchronization section and are therefore not fault tolerant (see FIG. 1), whereas in the present invention each communication controller 30, 32 A distributed communication system and method with independent clock synchronization and clock correction for each is described (see FIGS. 2A, 2B, and 2C, respectively,
A first embodiment of the node 100,
A schematic diagram of a second embodiment of node 100 ′ and a third embodiment of node 100 ″ is shown).

  This difference between the prior art dual channel based architecture (see diagram 1) and the single channel based architecture according to the present invention (see FIGS. 2A, 2B, and 2C) is the difference between the different channels 10,20. It is implemented so that the protocol engines 50, 52 of the communication controllers 30, 32 that work for it are essentially duplexed and thereby can be built into independent devices.

  In this context, the fault tolerant time trigger system according to the present invention includes two channels 10, 20 to which nodes are respectively connected. Each of these nodes has a respective bus controller 12, 22, a respective protocol engine 50, 52 and a respective communication controller 30, 32 with a respective controller host interface 40, 42, optionally a respective bus driver. Each bus guardian device, 12 and 22, as well as an application host 60 are included.

  Each bus driver 12, 22 transmits the bits and bytes provided by its respective communication controller 30, 32 on its respective connection channel 10, 20 and in turn receives on each channel 10, 20. The respective information to be provided is provided to the respective communication controllers 30 and 32.

  Each communication controller 30, 32 is connected to each channel 10, 20 via its respective bus driver 12, 22, delivers the relevant data to the host application 60, and receives data from the host application 60. The host application assembles the data into frames and delivers the data to the respective bus drivers 12,22.

  Each bus driver 12, 22, (optional) bus guardian, and host device 60 is at least partially time triggered, i.e., the time is sliced into circular cycles, each cycle containing several segments. The Each node determines the start of a new cycle according to its own built-in clock. At least one segment is divided into a fixed number of slots, where each slot is assigned at most one respective communication controller 30, 32, in which case only each communication controller 30, 32 is Has the authority to send. Other segments of the cycle can be used for dynamic arbitration schemes or other purposes.

  A bus guardian is a device with an independent set of configuration data that allows transmission on the bus only during the slot specified by the configuration set.

  The host application 60 includes a data source and a data sink and is generally not involved in protocol activity. Only the determination that each of the communication controllers 30 and 32 cannot be performed alone is performed by the host application 60.

  With respect to the present invention shown in FIGS. 2A-3B, the prior art dual channel based architecture (see FIG. 1) also needs to handle two quasi-independent channels 10, 20, so that FIG. Those skilled in the art will appreciate that the additional effort in the logic in a 2B, 2C single channel based architecture is almost negligible, ie, a handful of mechanisms need only be duplicated. Like.

  More specifically, a redundant communication channel is a single channel channel that uses two separate instances 30, 32 (see FIG. 2B), or an on-chip implementation in a single unit (see FIG. 2C). Can be based on architecture. Similarly, each local intra-channel communication interface is a chip external interface 54 (see FIG. 2B) or an on-chip interface 56 (see FIG. 2C).

  The nodes need to be synchronized with each other because each node gets its cycle start independently, thereby getting the placement of all segments and slots in time. Each node has its own clock so that its failure does not depend on a single master clock that will cause the entire system to fail. The difference between its own clock, called the synchronization node (or sink node), and the clock of some subset of the nodes of the system is used to correct its own clock in a fault tolerant manner.

Two types of clock correction, namely
Pure offset correction and a combination of offset correction and rate correction are possible.

  Offset correction simply corrects the clock offset, while rate correction also tries to match the different rates of the clocks in the system, thereby keeping the clocks closer to each other (the amount of offset correction required). Reduced, thereby increasing the available bandwidth since the mutual transmission gap is reduced).

  Since two measurements are required to calculate the rate deviation, for rate and offset correction, the clock is typically corrected at the end of one cycle or at the end of two cycles.

  All sink (synchronization) nodes need to transmit synchronization frames on both channels 10 and 20 simultaneously in one of their assigned slots. Accordingly, all nodes receive the same time information, and so does a node connected to only one channel.

  In order to apply synchronization between the two communication controllers 30, 32, each communication controller 30, 32 follows the timing difference between itself and its connected single channel communication controller in the opposite channel. Specifically, each single channel communication controller 30, 32 measures time relative to its own time, calculates offsets and rate differences by two possible methods, and either rate or offset correction Is used to calculate fault tolerant parameters, for example, by direct exchange of numerical values incorporating more information about the local clock and channel.

Regarding mathematical naming for this system,
Let z be the length of one cycle,
C is a set of all communication controllers 30 and 32.
Let A be the set of all communication controllers 30 in channel 10;
Let B be the set of all communication controllers 32 in channel 20,
The A _s a set of all communication controllers 30 configured to transmit synchronization frames of channel 10 (A _s ⊂A), and all configured to B _s to send a synchronization frame of the channel 20 Assume that the communication controller 32 is set (B _s ⊂B).

In the single channel architecture of FIGS. 2A, 2B, 2C, for each communication controller iεA _s there is a unique communication controller jεB _s , both of which belong to the same node, and vice versa. It is the same. Basically, this is present bijective s between _{A s} and _{B s,} however, for each node _{i∈A s, s (i) ∈B} s channel in the same node as the i Means 20 communication controllers (and for each node jεB _s s ⁻¹ (j) εA _s is the communication controller of channel 10 in the same node as j).

a, bεR ⁺ is an attenuation coefficient, a is for intra-channel clock correction, b is for inter-channel clock correction, and a and b may be selected separately for offset correction and rate correction (simplified) This is not reflected in the following equation).

Let T _i (t) be the real time of the cycle time t of the communication controller iεC. Thereby, T _i (0) becomes the real time when the controller i thinks that the communication cycle 1 may start, and T _i (z) becomes the communication controller i when the cycle 1 ends and the cycle 2 starts. Become real time when thinking.

Finally, the node i∈C rate as the tau _i becomes _{T i (t) = T i} (0) + τ i t.

  Regarding simple exchange, first, an algorithm for pure offset correction will be described.

  Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of the input sync (synchronization) frame with the expected arrival time.

を測定する。 Let iεA _s . Next, for each observable communication controller j∈A _s , j ≠ i, the communication controller i

Measure.

Repeat for all nodes iεB _s .

  When an offset measurement between a pair of communication controllers is performed within one cycle depends on the system configuration and is therefore represented by x.

M _{i, j} is the offset difference between the communication controller i and the communication controller j in cycle 1 after the last correction measured at the local time of the communication controller i, which is erroneous due to the measurement error ε.

も行われる。 In addition, the following measurements

Is also done.

Repeat for all nodes iεB _s .

  These are offsets for the other communication controller in the same node.

で計算され、
ただし、ＦＴは、フォールト・トレラント・オフセット計算アルゴリズムである。そのようなアルゴリズムの例が、Ｆｒｅｄ Ｂ．Ｓｃｈｎｅｉｄｅｒの「Ｕｎｄｅｒｓｔａｎｄｉｎｇ Ｐｒｏｔｏｃｏｌｓ ｆｏｒ Ｂｙｚａｎｔｉｎｅ Ｃｌｏｃｋ Ｓｙｎｃｈｒｏｎｉｚａｔｉｏｎ」、コーネル大学、ニューヨーク州Ｉｔｈａｃａ、１９８７年８月、に見つけられる。好ましい変形形態は、ＦＴＭ［フォールト・トレラント中点］アルゴリズムである。すべてのノードｉ∈Ｂ_ｓも、同様に行う。 In accordance with the present invention, the offset correction term for communication controller i is then:

Calculated by
However, FT is a fault-tolerant offset calculation algorithm. An example of such an algorithm is Fred B. et al. Found in Schneider's “Understanding Protocols for Byzantine Clock Synchronization”, Cornell University, Ithaca, New York, August 1987. A preferred variant is the FTM [Fault Tolerant Midpoint] algorithm. Repeat for all nodes iεB _s .

  If 1-1 / a-2 / b ≧ 0, it can be proved that this algorithm works and the clocks of both channels 10, 20 converge.

である。 Good values for a and b are

It is.

  In particular, a = 2 and b = 4 are very advantageous for implementation (ALU for division is not required, a simple shift is sufficient) and is a preferred choice.

  For simple exchange, an algorithm for offset correction and rate correction will now be described.

  Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of the input sync (synchronization) frame with the expected arrival time.

を測定する。 Let iεA _s . Next, for each observable communication controller j∈A _s , j ≠ i, the communication controller i

Measure.

Repeat for all nodes iεB _s .

When an offset measurement between a pair of communication controllers is performed within one cycle depends on the system configuration and is therefore represented by x _{i, j} .

M ¹ _{i, j} is an offset difference between the communication controller i and the communication controller j in the last corrected cycle 1 measured in the local time of the communication controller i, which is erroneous due to the measurement error ε. M ² _{i, j} is the offset difference between the communication controller i and the communication controller j in cycle 2 after the last correction measured at the local time of the communication controller i, which is erroneous due to the measurement error ε.

も行われる。 In addition, the following two measurements

Is also done.

Repeat for all nodes iεB _s .

  These are offsets for the other communication controller in the same node.

で計算され、
ただし、ＦＴは、フォールト・トレラント・オフセット計算アルゴリズムである。そのようなアルゴリズムの例が、Ｆｒｅｄ Ｂ．Ｓｃｈｎｅｉｄｅｒの「Ｕｎｄｅｒｓｔａｎｄｉｎｇ Ｐｒｏｔｏｃｏｌｓ ｆｏｒ Ｂｙｚａｎｔｉｎｅ Ｃｌｏｃｋ Ｓｙｎｃｈｒｏｎｉｚａｔｉｏｎ」、コーネル大学、ニューヨーク州Ｉｔｈａｃａ、１９８７年８月、に見つけられる。好ましい変形形態は、ＦＴＭ［フォールト・トレラント中点］アルゴリズムである。すべてのノードｉ∈Ｂ_ｓも、同様に行う。通信コントローラｉに対するレート補正項は、

で計算され、
ただし、ＦＴは、フォールト・トレラント・オフセット計算アルゴリズムである。そのようなアルゴリズムの例が、Ｆｒｅｄ Ｂ．Ｓｃｈｎｅｉｄｅｒの「Ｕｎｄｅｒｓｔａｎｄｉｎｇ Ｐｒｏｔｏｃｏｌｓ ｆｏｒ Ｂｙｚａｎｔｉｎｅ Ｃｌｏｃｋ Ｓｙｎｃｈｒｏｎｉｚａｔｉｏｎ」、コーネル大学、ニューヨーク州Ｉｔｈａｃａ、１９８７年８月、に見つけられる。好ましい変形形態は、ＦＴＭ［フォールト・トレラント中点］アルゴリズムである。すべてのノードｉ∈Ｂ_ｓも、同様に行う。 In accordance with the present invention, the offset correction term for communication controller i is then:

Calculated by
However, FT is a fault-tolerant offset calculation algorithm. An example of such an algorithm is Fred B. et al. Found in Schneider's “Understanding Protocols for Byzantine Clock Synchronization”, Cornell University, Ithaca, New York, August 1987. A preferred variant is the FTM [Fault Tolerant Midpoint] algorithm. Repeat for all nodes iεB _s . The rate correction term for communication controller i is

Calculated by
However, FT is a fault-tolerant offset calculation algorithm. An example of such an algorithm is Fred B. et al. Found in Schneider's “Understanding Protocols for Byzantine Clock Synchronization”, Cornell University, Ithaca, New York, August 1987. A preferred variant is the FTM [Fault Tolerant Midpoint] algorithm. Repeat for all nodes iεB _s .

  If 1-1 / a-2 / b ≧ 0, it can be proved that this algorithm works and the clocks of both channels 10, 20 converge.

である。 Good values for a and b are

It is.

  In particular, a = 2 and b = 4 are very advantageous for implementation (ALU for division is not required, a simple shift is sufficient) and is a preferred choice.

  In the following, an example of an algorithm for offset correction and rate correction is presented.

  Let FT be the FTM [Fault Tolerant Midpoint] algorithm. FTM can tolerate up to k Byzantine faults if more than 2k + 1 measurements are obtained.

  The FTM algorithm sorts the allowed values and removes the lowest k values and the highest k values. The FTM algorithm then selects the remaining maximum value and the remaining minimum value and calculates the average of both.

Regarding the offset correction of node i, after removing the upper and lower values,
The measured value of the offset difference at the node L _i is the minimum value, and the measured value of the offset difference at the node H _i is the maximum value.

ということになる。 Therefore,

It turns out that.

ということになる。 For a = 2 and b = 4, the calculation of the correction term is

It turns out that.

  For rate correction and FTM, the results are similar.

  Otherwise, FIGS. 3A and 3B show examples of how measurements between two associated communication controllers 30, 32 are made in a simple manner.

  FIG. 3A shows how the single channel communication controller 30 of the first channel 10 and the single channel communication controller 32 of the second channel 20 can exchange their clock information with one signal each. It shows about. The two communication controllers 30 and 32 measure their offset and change the length of cycle c to compensate for it (→ cycle boundary bo is uncorrected, whereas cycle boundary bw is corrected) And the difference between bw and bo is the correct offset co). To make this mechanism fault tolerant, the function f is used. If the propagation delay of the signal is known, it can be compensated for increased accuracy.

  FIG. 3B shows how the single channel communication controller 30 of the first channel 10 and the single channel communication controller 32 of the second channel 20 can exchange their clock information with one signal each. It shows. The two communication controllers 30, 32 measure their offset difference and rate difference and change the length of the cycle c to compensate for it (→ cycle boundary bo without correction, to it The cycle boundary bw is corrected, and the difference between bw and bo is the correct offset / correct rate cor). Functions f and g are used to make this mechanism fault tolerant. If the propagation delay of the signal is known, it can be compensated for increased accuracy.

  With respect to characteristics, the algorithm described above is fast and does not require a complex additional interface between the two associated communication controllers 30,32.

  Since the measurement of the time difference between one communication controller 30 (or 32) and its associated communication controller 32 (or 30) can be made during a normal communication cycle c, the correction calculation need not be delayed. However, the achievable accuracy can be significantly reduced compared to conventional techniques. In particular, the non-sync (synchronous) nodes of the different channels 10, 20 are subject to potentially large clock differences.

  a and b are not fixed to the optimal choice, but are configurable for compatibility with single channel systems, in which case the choice of 1 is optimal (second No additional terms from channel 20 need be incorporated).

  Regarding the complex exchange, first, an algorithm for pure offset correction will be described.

  Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of the input sync (synchronization) frame with the expected arrival time.

を測定する。 Let iεA _s . Next, for each observable communication controller j∈A _s , j ≠ i, the communication controller i

Measure.

Repeat for all nodes iεB _s .

When an offset measurement between a pair of communication controllers is performed within one cycle depends on the system configuration and is therefore represented by x _{i, j} .

M _{i, j} is the offset difference between the communication controller i and the communication controller j in cycle 1 after the last correction measured at the local time of the communication controller i, which is erroneous due to the measurement error ε.

が計算され、
ただし、ＦＴは、フォールト・トレラント・オフセット計算アルゴリズムである。そのようなアルゴリズムの例が、Ｆｒｅｄ Ｂ．Ｓｃｈｎｅｉｄｅｒの「Ｕｎｄｅｒｓｔａｎｄｉｎｇ Ｐｒｏｔｏｃｏｌｓ ｆｏｒ Ｂｙｚａｎｔｉｎｅ Ｃｌｏｃｋ Ｓｙｎｃｈｒｏｎｉｚａｔｉｏｎ」、コーネル大学、ニューヨーク州Ｉｔｈａｃａ、１９８７年８月、に見つけられる。好ましい変形形態は、ＦＴＭ［フォールト・トレラント中点］アルゴリズムである。すべての通信コントローラｉ∈Ｂ_ｓに対して、同じく、

が行われる。 According to the present invention, then, for each communication controller I∈A _s, the following terms by:

Is calculated,
However, FT is a fault-tolerant offset calculation algorithm. An example of such an algorithm is Fred B. et al. Found in Schneider's “Understanding Protocols for Byzantine Clock Synchronization”, Cornell University, Ithaca, New York, August 1987. A preferred variant is the FTM [Fault Tolerant Midpoint] algorithm. For all communication controllers i∈B _s ,

Is done.

を計算することができる。 Each node iεA _s then sends its correction term δ _i ^offset to its associated communication controller s (i), which in turn receives δ _{s (i)} ^offset from its associated communication controller s (i). Next, the communication controller i sets the offset correction term.

Can be calculated.

Repeat for all nodes iεB _s .

  If 1-1 / a-1 / b ≧ 0 and a = b, it can be proved that this algorithm works and the clocks of both channels 10, 20 converge.

である。 Good values for a and b are

It is.

  In particular, a = 2 and b = 2 are very advantageous for implementation (ALU for division is not required, a simple shift is sufficient) and is a preferred choice.

  For complex exchanges, an algorithm for offset correction and rate correction will now be described.

  Each node measures the difference between its own clock and the clocks of all observable nodes. This is done in FlexRay by comparing the arrival time of the input sync (synchronization) frame with the expected arrival time.

を測定する。 Let iεA _s . Next, for each observable communication controller j∈A _s , j ≠ i, the communication controller i

Measure.

Repeat for all nodes iεB _s .

When an offset measurement between a pair of communication controllers is performed within one cycle depends on the system configuration and is therefore represented by x _{i, j} .

M ¹ _{i, j} is an offset difference between the communication controller i and the communication controller j in the last corrected cycle 1 measured in the local time of the communication controller i, which is erroneous due to the measurement error ε.

M ² _{i, j} is the offset difference between the communication controller i and the communication controller j in cycle 2 after the last correction measured at the local time of the communication controller i, which is erroneous due to the measurement error ε.

が計算され、
ただし、ＦＴは、フォールト・トレラント・オフセット計算アルゴリズムである。そのようなアルゴリズムの例が、Ｆｒｅｄ Ｂ．Ｓｃｈｎｅｉｄｅｒの「Ｕｎｄｅｒｓｔａｎｄｉｎｇ Ｐｒｏｔｏｃｏｌｓ ｆｏｒ Ｂｙｚａｎｔｉｎｅ Ｃｌｏｃｋ Ｓｙｎｃｈｒｏｎｉｚａｔｉｏｎ」、コーネル大学、ニューヨーク州Ｉｔｈａｃａ、１９８７年８月、に見つけられる。好ましい変形形態は、ＦＴＭ［フォールト・トレラント中点］アルゴリズムである。すべての通信コントローラｉ∈Ｂ_ｓに対して、同じく、

が行われる。 According to the present invention, then, for each communication controller I∈A _s, the following terms by:

Is calculated,
However, FT is a fault-tolerant offset calculation algorithm. An example of such an algorithm is Fred B. et al. Found in Schneider's “Understanding Protocols for Byzantine Clock Synchronization”, Cornell University, Ithaca, New York, August 1987. A preferred variant is the FTM [Fault Tolerant Midpoint] algorithm. For all communication controllers i∈B _s ,

Is done.

およびそのレート補正項

を、計算することができる。 Each node iεA _s then sends its correction terms δ _i ^offset and δ _i ^rate to its associated communication controller s (i), which in turn δ _{s (i)} ^offset and δ _{s (i)} ^rate Received from the associated communication controller s (i). Next, the communication controller i sets the offset correction term.

And its rate correction term

Can be calculated.

Repeat for all nodes iεB _s .

  If 1-1 / a-1 / b ≧ 0 and a = b, it can be proved that this algorithm works and the clocks of both channels 10, 20 converge.

である。 Good values for a and b are

It is.

  In particular, a = 2 and b = 2 are very advantageous for implementation (ALU for division is not required, a simple shift is sufficient) and is a preferred choice.

  In the following, an example of an algorithm for offset correction and rate correction is presented.

  Let FT be the FTM [Fault Tolerant Midpoint] algorithm. FTM can tolerate up to k Byzantine faults if more than 2k + 1 measurements are obtained.

  The FTM algorithm sorts the allowed values and removes the lowest k values and the highest k values. The FTM algorithm then selects the remaining maximum value and the remaining minimum value and calculates the average of both.

Regarding the offset correction of node i, after removing the upper and lower values,
The measured value of the offset difference at the node L _i is the minimum value, and the measured value of the offset difference at the node H _i is the maximum value.

ということになる。 Therefore,

It turns out that.

  In brackets, terms that actually apply are presented, not terms that need to be calculated in i. This formula is useful for analyzing the behavior of this algorithm.

ということになる。 For a = 2 and b = 2, the calculation of the correction term is

It turns out that.

  For rate correction and FTM, the results are similar.

  In terms of characteristics, the algorithm described above is fairly quick, but requires an interface between the two associated communication controllers 30, 32 in order to exchange δ values.

  In addition, the measurement of the time difference between one communication controller 30 (or 32) and its associated communication controller 32 (or 30) cannot be made during a normal communication cycle and is exchanged after the first FT calculation, so The exchange of the necessary δ values and subsequent additional calculations delays the correction term calculation.

  In particular, the exchange takes some time because both communication controllers 30 and 32 are affected by the offset. Both communication controllers 30 and 32 can finally complete the calculation of their correction terms when the slowest one is finished. This can only work if both communication controllers 30, 32 differ only within the boundaries that need to be guaranteed by system startup, otherwise clock synchronization cannot be "activated". After this condition is given, the clock synchronization algorithm can keep the associated controllers 30, 32 within these boundaries.

  The aforementioned algorithm has the advantage that the achievable accuracy is almost the same as in the conventional dual channel architecture. Only non-sync (synchronous) nodes are affected by slightly higher clock differences.

  a and b need to be chosen identically to achieve the highest possible accuracy. Therefore, only one configuration parameter shall be given to both. This configuration parameter is not two optimal choices, but should be further configurable for compatibility with a single channel system, in which case the choice of 1 is optimal (second channel No additional terms from 20 need to be incorporated).

  Overall, the present invention is likely to be on the same chip on different channels 10, 20 (see FIG. 2C), but not necessarily (see FIG. 2B), two independent single channel communication controllers Propose a new way to synchronize the operation of 30, 32 and effectively emulate the behavior of the two-channel controller CC (see Figure 1), thereby creating a single-channel or dual-channel communication controller A cost-effective IC [integrated circuit] block can be created that can be used to do so.

  In the present invention, the communication controllers 30 and 32 are the most important. Bus drivers 12, 22, bus guardian, and host device 60 are listed to provide an overall technical concept in which the present invention may be used in that context. The present invention is not limited or limited by the presence or absence of these devices.

1 is a schematic diagram showing a network system according to the prior art. FIG. 1 is a schematic diagram illustrating a first embodiment of a fault tolerant time-triggered network system according to the present invention that operates according to the method of the present invention. FIG. 3 is a schematic diagram illustrating a second embodiment of a fault-tolerant time-triggered network system according to the present invention that operates according to the method of the present invention. FIG. 4 is a schematic diagram illustrating a third embodiment of a fault-tolerant time-triggered network system according to the present invention that operates according to the method of the present invention. FIG. 3 is a schematic diagram showing the measurement of their offsets and the change in cycle length as a function of time t, showing clock information exchange between two single channel communication controllers according to the present invention. FIG. 4 is a schematic diagram showing the measurement of their offsets and their rate differences and the change in cycle length as a function of time t, showing clock information exchange between two single channel communication controllers according to the present invention.

Explanation of symbols

100 nodes (see the first embodiment of the present invention, FIG. 2A)
100 ′ node (second embodiment of the present invention, see FIG. 2B)
100 "node (third embodiment of the invention, see FIG. 2C)
10 first channel 12 bus driver 20 of first channel 10 second channel 22 bus driver 30 of second channel 12 communication controller 32 assigned to first channel 10 in particular second channel Assigned to the communication controller 40, in particular the controller host interface 42 assigned to the first communication controller 30, in particular the controller host interface 50 assigned to the second communication controller 32, in particular the first communication. Protocol engine 52 assigned to the controller 30, in particular the protocol engine 54 assigned to the second communication controller 32, a local intra-channel communication external interface (see the second embodiment of the invention, FIG. 2B)
56 Local intra-channel communication on-chip interface (third embodiment of the invention, see FIG. 2C)
60 Application host B1 Bus driver for first channel C1 (prior art, see FIG. 1)
B2 Second channel C2 bus driver (prior art, see FIG. 1)
C1 first channel (prior art, see FIG. 1)
C2 Second channel (prior art, see FIG. 1)
CC communication controller (prior art, see Fig. 1)
Controller host interface of CI communication controller CC (prior art, see Fig. 1)
H Application host (prior art, see Figure 1)
N node (prior art, see Figure 1)
P Protocol engine of communication controller CC (see prior art, Fig. 1)
bw Cycle boundary with correction bo Cycle boundary without correction c Cycle co Correct offset cor Correct offset / correct rate f Function

Claims (10)

A method for operating a distributed communication system in which a plurality of nodes are interconnected by at least one communication link including at least two channels, and in particular for synchronizing clocks in such a distributed communication system. ,
A method characterized in that each channel is controlled by its own communication controller.   The method of claim 1, wherein the clock offset difference and the clock rate difference are corrected to synchronize the clock. A computer program capable of running on at least one computer, in particular on at least one microprocessor,
A computer program programmed to carry out the method according to claim 1 or 2.   4. Computer program according to claim 3, characterized in that it is stored in at least one ROM [Read Only Memory], at least one RAM [Random Access Memory] or at least one flash memory. A node of a distributed communication system, wherein a plurality of nodes are interconnected by at least one communication link including at least two channels,
A node characterized in that at least one communication controller is assigned to each channel. Characterized by means for synchronizing the clocks of the nodes;
6. The node of claim 5, wherein the means corrects the clock offset difference and the clock rate difference. Characterized by at least one bus guardian for controlling access of the communication controller to the communication link;
The node according to claim 5 or 6, wherein the corrected clock signal is made available to the bus guardian, and the bus guardian adapts its clock accordingly. A node according to at least one of claims 5 to 7, characterized by means for executing the method according to claim 1 or 2 and / or the computer program according to claim 3 or 4. .   9. A distributed communication system with several nodes according to at least one of claims 5 to 8, characterized in that the communication system is fault tolerant and / or time triggered. 5. The method of claim 1 or 2 and / or of at least one computer program of claim 3 or 4 for synchronizing clocks in at least a dual channel environment. Use of at least one node according to at least one of 5 to 8 and / or the communication system according to claim 9, comprising:
Usage wherein the clock offset difference and the clock rate difference can be corrected.

Images