JP2020167616A - Time synchronization system and relay device - Google Patents

Abstract

To improve time synchronization in a communication system.SOLUTION: A time synchronization system for synchronizing time on the slave side with a grand master clock includes a device functioning as a grand master, one or more devices functioning as an adjacent relay, and one or more devices functioning as a terminal that are connected via a network. The grand master transmits a signal including a clock to the network. The terminal corrects time on the basis of the clock, adds a correction amount of time to a correction integrated value α included in the terminal, and transmits a grand master abnormality notification message to the network when α exceeds a predetermined threshold. The adjacent relay corrects time of the adjacent relay on the basis of the clock, adds a correction amount of time to α included in the adjacent relay, and transmits to the network a message showing that a grand master should be determined again when α exceeds a predetermined threshold and grand master abnormality notification messages are received from one or more subordinate devices.SELECTED DRAWING: Figure 6

Description

The present invention relates to a time synchronization system and a relay device.

In recent years, a plurality of in-vehicle devices have come to be interconnected. Therefore, it is necessary to synchronize the time between the interconnected devices.

Patent Document 1 describes in a time synchronization system having a master device having a master clock and a slave device that performs a time synchronization process for synchronizing the clock of the own device with the master clock of the master device. It is described that an integrated message that integrates a time synchronization message containing information and a line quality message including line quality information indicating the status of the own device is transmitted to the slave device instead of the time synchronization message.

Further, as the processing of the slave device in Patent Document 1, when the slave device notifies the failure of the master device by the line quality information included in the integrated message received from the master device, the time included in the integrated message. It is described that the information is used to control the master clock of the own device so as not to perform the time synchronization process.

Patent Document 2 describes a receiving unit which is a relay device and receives a first synchronization packet including time information from a master device, and a delay time generated in the own device based on the first synchronization packet. A time information processing unit that generates a second synchronization packet containing the indicated time information, a failure detection unit that monitors whether or not a failure has occurred in the own device, and a failure detection unit that monitors whether or not a failure has occurred, and if no failure has occurred , A transmission unit that transmits the second synchronization packet to the slave device, and an abnormality processing unit that executes an abnormality processing for the second synchronization packet when a failure occurs. The relay device to have is described.

Japanese Unexamined Patent Publication No. 2015-216438 JP-A-2017-216563

Further improvements were needed in the time synchronization of the communication system.

An object of the present invention is to improve the time synchronization of a communication system.

In a time synchronization system that synchronizes the clock on the slave side with the grand master clock, a device that functions as a grand master, one or more devices that function as adjacent repeaters adjacent to a device that functions as a grand master, and functions as a terminal. One or more devices are connected via a network. The device functioning as the ground master transmits a signal including the ground master clock on the network, and the device functioning as the terminal corrects the time of the device functioning as the terminal based on the ground master clock. The correction amount at that time is integrated into the correction integration value α possessed by the device functioning as the terminal, and when the correction integration value α exceeds a predetermined threshold value, a grand master abnormality notification message is transmitted on the network. The device functioning as the adjacent repeater corrects the time of its own device based on the ground master clock, integrates the correction amount of the time into the correction integrated value α of its own device, and integrates the correction integrated value α. When a predetermined threshold is exceeded and a grand master abnormality notification message is received from one or more subordinate devices, a message indicating that the grand master should be determined again is displayed on the network. Send. With the above configuration, the time synchronization of the communication system is improved.

According to the present invention, the time synchronization of the communication system is improved.

The figure which shows the configuration example of the network 100 in the time synchronization system of this disclosure. The figure which shows the configuration example of the apparatus which functions as a terminal in the network 100 shown in FIG. The figure which shows the configuration example of the apparatus which functions as a repeater in the network 100 shown in FIG. Flow diagram of processing performed by a device that functions as a grand master Flow diagram of processing performed by a device that functions as a terminal Flow diagram of processing performed by a device that functions as a repeater Diagram showing the flow direction of the Grandmaster error notification message A sequence diagram showing a basic example of a situation in which the grandmaster redetermination process is triggered in the time synchronization system of the present disclosure.

Hereinafter, a detailed description will be given with reference to the drawings as appropriate. It should be noted that the accompanying drawings and the following description are provided for those skilled in the art to fully understand the present disclosure, and are not intended to limit the subject matter described in the claims.

(Knowledge that led to the invention)
In recent years, in-vehicle devices include a wide variety of devices such as cameras and distance sensors, which are interconnected by an in-vehicle network. For example, in order for the right speaker and the left speaker to sound at the same time, or for the images of cameras attached to various parts of the vehicle to be displayed at the same time, time synchronization between the in-vehicle devices is required. Synchronization between in-vehicle devices used for autonomous driving is also required. Accuracy is important for these time synchronizations.

As a mechanism capable of performing accurate time synchronization, for example, there is a gPTP protocol in Ethernet AVB.

Ethernet AVB (Audio Video Bridging) is a communication network technology standardized by IEEE in order to transmit and receive signals such as audio signals and video signals that are subject to strict timing restrictions on the LAN of IEEE802.

Ethernet AVB includes gPTP (generalized Precision Time Protocol) (IEEE 802.1AS), which is a protocol for handling time synchronization. In this gPTP protocol, a reference Grand Master is automatically determined. As an algorithm for this determination, BMCA (Best Master Clock Algorithm) or the like is used.

Ethernet AVB is applied to a network consisting of a terminal (device) and a repeater (device), and the grandmaster determination algorithm by BMCA (Best Master Clock Algorithm) synchronizes the time by the following two procedures. It is being carried out.

Step 1: Step 1 to determine the grand master (device) in the network (1-1) The own device broadcasts a message called Announce, which includes the clock accuracy of the own device, on the network.
(1-2) When an Announce message with higher accuracy than the own device is received, the broadcast of the Unknown message of the own device is stopped.
(1-3) It is determined that the device that continues to send the Unknown message until the end is the grand master.

Step 2: The slave (device) synchronizes the time with the grand master (device) (2-1) The grand master periodically broadcasts time information called a Sync message on the network.
(2-2) Each slave compares the time indicated in the Sync message with the time of its own device, corrects the error, and synchronizes with the time of the grand master.

As shown in the above two procedures, the grandmaster determined by BMCA multicasts its own time (grandmaster clock) over the network, and other devices (slaves) in the network send it to it. By adjusting the time, highly accurate time synchronization is possible.

Here, the inventions described in Patent Document 1 and Patent Document 2 described above are all constructed on the premise that the own device can detect a failure. In fact, Patent Document 1 is a method of preventing deterioration of time synchronization accuracy in a network by preventing the master from reporting its own clock failure and causing clock synchronization with devices in the network.

The relay device described in Patent Document 2 also deteriorates the time synchronization accuracy in the network by preventing the relay device from reporting its own clock failure and synchronizing the clock with the subordinate (slave) device. It is something to prevent.

Therefore, in a system that synchronizes the time with the clock of the grand master, if the grand master cannot detect its own failure due to a failure or virus infection, it will detect even if the error of the reference grand master clock itself is accumulated. , There is no way to correct it. Therefore, the time shift of the entire network occurs, and the time synchronization accuracy of the entire network deteriorates.

Given the current situation as described above, it has been desired to construct a system in which the time synchronization accuracy of the entire network does not deteriorate even if the grandmaster cannot detect its own failure.

Therefore, in the time synchronization system of the present disclosure, each device in the network monitors and detects an error of the grand master clock to prevent deterioration of the time synchronization accuracy. Hereinafter, such a system will be described.

(Basic configuration)
In the time synchronization system of the present disclosure, each device in the network monitors and detects an error of the grand master clock issued by the grand master. When the system uses the gPTP protocol for time synchronization, the subject performing this monitoring and detection is a device corresponding to the gPTP protocol. A device that supports the gPTP protocol functions as a terminal, a repeater, or a grandmaster. The same device sometimes functions as a terminal, sometimes functions as a repeater, and sometimes functions as a grand master (when selected as a grand master).

The device that functions as a terminal and the device that functions as a repeater are used to detect an abnormality in the device that functions as a grand master (hereinafter, may be simply referred to as "abnormality detection" or "abnormality detection"). , Implement an algorithm as described below. Then, when an abnormality is detected, a grand master abnormality notification message (abnormality notification) is broadcast to the network. When a device functioning as a repeater (adjacent repeater) adjacent to a device functioning as a grand master receives the abnormality notification, and the device functioning as the repeater also detects an abnormality, the entire network Assuming that it is abnormal, the grandmaster determination process described in (1-1) to (1-3) above is performed again (grandmaster redetermination process).

In the grandmaster determination process that is performed again, the grandmaster determination process is performed with the device in which the error occurred (the device that functioned as the previous grandmaster) excluded from the candidates for the next grandmaster. Do. This is because it is obvious that the accuracy of time synchronization deteriorates again when the device in which the abnormality occurs is selected as the grand master again. This exclusion method will be described later.

As a general rule, with the above configuration, even if the device that functions as the grand master cannot detect its own abnormality, other devices existing in the network have an abnormality in the device that functions as the grand master. Can be detected. Further, it is not determined that the entire network is abnormal by the determination of only one device. When both the at least one device and the device functioning as a repeater adjacent to the grand master detect an abnormality, the grand master redetermination process is triggered.

Hereinafter, a more detailed configuration of the above time synchronization system will be described. First, the network configuration is shown, then the configuration of the devices included in the network is shown, and based on these, the processing flow of the time synchronization system of the present disclosure will be described.

(Network configuration)
FIG. 1 is a diagram showing a configuration example of a network 100 in the time synchronization system of the present disclosure. A device 101, a device 111, a device 112, a device 113, a device 114, a device 115, a device 121, a device 122, and a device 123 exist in the network 100 and are connected to each other in a star shape. The network topology is not limited to the star type.

In the illustrated state of the network 100, the device 101 functions as a grand master. That is, the device 101 is determined as the grand master by the above steps (1-1) to (1-3).

In gPTP (generalyzed Precision Time Protocol) (IEEE 802.1AS), the network configuration is a master / slave structure, and the clock master port of a certain device is connected to the clock slave port of a subordinate device. In the example of FIG. 1, it is as follows.

The clock master port of the device 101 that functions as a grand master and the clock slave port of the subordinate device 111 are connected. The device 111 functions as an adjacent repeater. The clock master port of the device 111 and the clock slave ports of the subordinate devices 112 and 113 are connected, respectively. In this example, devices 112 and 113 function as repeaters, respectively. The clock master port of the device 113 and the clock slave ports of the subordinate devices 114 and 115 are connected, respectively. In this example, devices 114 and 115 function as repeaters. The clock master port of the device 114 and the clock slave port of the subordinate device 121 are connected. The device 121 functions as a terminal. The clock master port of the device 115 and the clock slave ports of the subordinate devices 122 and 123 are connected, respectively. The devices 122 and 123 function as terminals, respectively.

At this time, the Sync message described in (2-1) above, which is used for time synchronization, is propagated from the master device to the slave device in the direction indicated by the arrow in FIG.

(Terminal configuration)
FIG. 2 shows a configuration example of a device that functions as a terminal in the network 100 shown in FIG. Hereinafter, for convenience, the device that functions as a terminal may be referred to as a terminal 20.

The terminal 20 includes a receiving unit 201, a transmitting unit 202, a time correction unit 203, an error determination unit 204, and a clock 205. It should be noted that functional blocks other than these may be provided, and a plurality of functional blocks may be mounted on the same hardware resource (CPU, memory, etc.) or separately. The arrows in FIG. 2 indicate a typical flow of data. However, not all data flows as indicated by the arrows. In addition, there may be a data flow (not shown).

The receiving unit 201 receives an Ethernet packet from an adjacent terminal / repeater. Of the received packets, the information corresponding to the Sync message is sent to the time correction unit 203 described later. The other information is appropriately processed inside the terminal 20, and the information that needs to be transmitted to the outside is sent to the transmission unit 202. Note that the Sync message is periodically issued by a device that functions as a grand master in the network, and devices other than the grand master synchronize the time of their own device with the time of the grand master based on this Sync message. Is.

The transmission unit 202 transmits an Ethernet packet to an adjacent terminal / repeater. Further, the transmission unit 202 transmits the grand master abnormality notification message (abnormality notification) generated by the error determination unit 204 as an Ethernet packet to the outside. The generation of the grand master abnormality notification message (abnormality notification) by the error determination unit 204 will be described later.

Here, when the clock accuracy of the terminal 20 is the highest in the network, the terminal 20 may function as a grand master through the steps (1-1) to (1-3) above. When the terminal 20 functions as a grand master, the transmission unit 202 transmits the Sync message generated based on the clock 205 as an Ethernet packet. Other devices in the network perform time synchronization based on this Sync message.

The time correction unit 203 synchronizes with the clock of the grand master by correcting the time of the terminal 20 itself based on the Sync message received by the reception unit 201. The time correction unit 203 sends information indicating the time correction amount Δ in the time correction to the error determination unit 204.

The error determination unit 204 has a correction integrated value α. The correction integrated value α is a value obtained by integrating the correction amount Δ sent from the time correction unit 203 each time it is received. For example, when four correction amounts of 0.01 μs, −0.02 μs, 0.03 μs, and 0.02 μs are sequentially given as correction amounts Δ in a state where α = 0 is reset, the correction integrated value α = 0.01-0.02 + 0.03 + 0.02 = 0.04 μs. The correction amount of a positive value means the correction in the direction of advancing the time, and the correction amount of the negative value means the correction in the direction of moving the time forward.

Further, the error determination unit 204 compares the correction integrated value α with a predetermined threshold value β. This threshold value β is provided to eliminate erroneous determination due to an instantaneous error. When the correction integrated value α exceeds the threshold value β, the error determination unit 204 sends a grand master abnormality notification message (abnormality notification) to the transmission unit 202. It should be noted that the transmission unit 202 transmits this grand master abnormality notification message (abnormality notification) to the outside as described above.

The clock 205 is the clock of the terminal 20 (own device). When the terminal 20 functions as a grand master, a Sync message is generated based on this clock and transmitted to the outside via the transmission unit 202.

(Structure of repeater)
FIG. 3 shows a configuration example of a device that functions as a repeater in the network 100 shown in FIG. Hereinafter, for convenience, the device that functions as a repeater may be referred to as a repeater 30.

The repeater 30 includes a receiving unit 301, a transmitting unit 302, a time correction unit 303, an error determination unit 304, a clock 305, and an abnormality notification determination unit 306. It should be noted that functional blocks other than these may be provided, and a plurality of functional blocks may be mounted on the same hardware resource (for example, CPU, memory, etc.) or separately. The arrows in FIG. 3 show a typical flow of data. However, not all data flows as indicated by the arrows. In addition, there may be a data flow (not shown).

Comparing the terminal 20 shown in FIG. 2 with the repeater 30 shown in FIG. 3, substantially the same functional blocks exist. On the other hand, although the repeater 30 has an abnormality notification determination unit 306, a functional block corresponding to the abnormality notification determination unit 306 is not described in the terminal 20 shown in FIG.

The receiving unit 301 receives an Ethernet packet from an adjacent terminal or repeater. Of the received packets, the information corresponding to the Sync message is sent to the time correction unit 303, which will be described later. The message relayed by the repeater 30 is sent to the transmission unit 302. The other information is appropriately processed inside the repeater 30, and the information that needs to be transmitted to the outside is sent to the transmission unit 302. Note that the Sync message is periodically issued by a device that functions as a grand master in the network, and devices other than the grand master synchronize the time of their own device with the grand master based on this Sync message. ..

The transmission unit 302 transmits an Ethernet packet to an adjacent terminal / repeater. Further, the transmission unit 302 transmits the grand master abnormality notification message (abnormality notification) generated by the abnormality notification determination unit 306 as an Ethernet packet to the outside. The generation of the grand master abnormality notification message (abnormality notification) by the abnormality notification determination unit 306 will be described later. Further, the transmitting unit 302 relays the message sent from the receiving unit 301 to another terminal / repeater.

Since the repeater 30 is a device, like the terminal 20 in FIG. 2, the repeater 30 can also be a grandmaster (when the clock accuracy is the highest in the network). When the repeater 30 functions as a grand master, the transmission unit 302 transmits the Sync message generated by the clock 305 as an Ethernet packet. Other devices in the network perform time synchronization based on this Sync message.

The time correction unit 303 synchronizes with the clock of the grand master by correcting the time of the repeater 30 itself based on the Sync message received by the reception unit 301. The time correction unit 303 sends information indicating the time correction amount Δ in the time correction to the error determination unit 304.

The error determination unit 304 has a correction integrated value α. The correction integrated value α is a value obtained by integrating the correction amount Δ sent from the time correction unit 303 each time it is received. For example, when four correction amounts of 0.01 μs, −0.02 μs, 0.03 μs, and 0.02 μs are sequentially given as correction amounts Δ in a state where α = 0 is reset, the correction integrated value α = 0.01-0.02 + 0.03 + 0.02 = 0.04 μs. The correction amount of a positive value means the correction in the direction of advancing the time, and the correction amount of the negative value means the correction in the direction of moving the time forward.

Further, the error determination unit 304 compares the correction integrated value α with a predetermined threshold value β. This threshold value β is provided to eliminate erroneous determination due to an instantaneous error. When the correction integrated value α exceeds the threshold value β, the error determination unit 304 notifies the abnormality notification determination unit 306 of the abnormality.

The clock 305 is the clock of the repeater 30 (own device). When the repeater 30 functions as a grand master, a Sync message is generated based on this clock and transmitted to the outside via the transmission unit 302.

The abnormality notification determination unit 306 stores the abnormality notification (abnormality A) received from the error determination unit 304 and the grand master abnormality notification message (abnormality B) received from the reception unit 301.

The process performed when (abnormal A) and (abnormal B) are aligned differs depending on whether or not the repeater 30 is adjacent to a device that functions as a grand master.

If the repeater 30 is a non-adjacent repeater that is not adjacent to the device that functions as the grand master, the abnormality notification determination unit 306 will perform the grand master when the (abnormality A) and (abnormality B) are aligned. An abnormality notification message (abnormality notification) is sent to the transmission unit 302. That is, when the terminal / repeater under the repeater 30 detects an abnormality and the repeater 30 itself also detects an abnormality, the grand master abnormality notification message is transmitted from the abnormality notification determination unit 306 to the transmission unit 302. Will be sent to.

On the other hand, when the repeater 30 is an adjacent repeater adjacent to the device functioning as the grand master, it is determined that the entire network is abnormal when the above (abnormality A) and (abnormality B) are aligned. Trigger the execution of the grand master determination process (procedures (1-1) to (1-3)) again.

There may be a plurality of terminals and other repeaters under the repeater 30. Here, when the grand master abnormality notification message (abnormality notification) is received from any one of the terminals / repeaters under the repeater 30 via the receiving unit 301, it is determined that (abnormality B) is complete. can do.

Further, as a modification, when the grandmaster abnormality notification message (abnormality notification) is received from the majority of the terminals / repeaters under the repeater 30 via the receiving unit 301, (abnormality B) is complete. May be determined. Further, as a further modification, a grandmaster abnormality notification message (abnormality notification) is given from all the terminals / repeaters under the repeater 30 that comply with the time synchronization protocol (for example, gPTP protocol) used. ) Is received via the receiving unit 301, it may be determined that (abnormality B) is complete.

Based on the above, an example of the processing flow performed by each device included in the time synchronization system of the present disclosure will be described.

(Grandmaster processing flow)
FIG. 4 is a flow chart of processing performed by a device functioning as a grand master. It should be noted that the start time of the flow chart is immediately after the steps (1-1) to (1-3) are performed and the grand master is determined.

In step S101, the device generates a Sync message. This generation process may be generated by a processing means such as a CPU (not shown) based on the clock 205/305 of the own device.

In step S102, the generated Sync message is transmitted from the transmission unit 202/302 to the outside.

Hereinafter, the steps S101 and S102 are periodically repeated (for example, once every 125 milliseconds) until the grandmaster determination process is performed again.

(Terminal processing flow)
FIG. 5 is a flow chart of processing performed by a device (terminal 20) that functions as a terminal. The device that functions as a terminal performs "error determination unit processing". The processing flow of this error determination processing is as follows, for example. The flow starts immediately after the steps (1-1) to (1-3) are performed and the grand master is determined.

In step S201, the value of the correction integrated value α possessed by the error determination unit 204 is cleared to 0.

In step S202, it is determined whether or not the receiving unit 201 has received the Sync message. If it is received (yes), the process proceeds to step S203. If it is not received (No), the process returns to step S202. That is, it waits for the reception of the Sync message.

In step S203, it is determined whether or not to correct the time from the Sync message received by the time correction unit 203 via the reception unit 201. If there is time correction (yes), the process proceeds to step S204. If there is no time correction (No), the process returns to step S202. The case where there is no time correction is when the correction amount Δ = 0.

In step S204, the time of the terminal 20 is corrected by the correction amount Δ. That is, the time is synchronized with the grand master. Regarding the positive and negative values of Δ, the one that advances the time of the terminal 20 is a positive value, and the one that returns the time of the terminal 20 is a negative value.

In step S205, the correction amount Δ is added to the correction integrated value α included in the error determination unit 204.

In step S206, the error determination unit 204 compares the absolute value of the correction integrated value α with the predetermined threshold value β. When | α |> β (in the case of Yes), the process proceeds to step S207. If | α | ≦ β (if No), the process returns to step S202.

The value of the predetermined threshold value β may be a fixed value.

Further, the value of the predetermined threshold value β may be a value based on the clock error (jitter) of the clock 205. The clock of the terminal 20 that is not the grandmaster should be less accurate than the clock of the grandmaster. This is because, as described above, the grand master is determined according to the above procedures (1-1) to (1-3) using BMCA, and the accuracy of the grand master clock should be the highest. Therefore, if the clock of the grand master is normal, it is considered that an error larger than the clock error (jitter) of the clock 205 does not occur. For example, the threshold value β may be a value that is N times the clock error (N is an integer of 1 or more).

Step S207 is a process to be executed when the correction integrated value α exceeds a predetermined threshold value β. At this time, the terminal 20 notifies the network of the abnormality. More specifically, the error determination unit 204 sends the grand master abnormality notification message to the transmission unit 202, and the transmission unit 202 transmits this grand master abnormality notification message to the outside. Then, the process returns to step S201.

(Transponder processing flow)
FIG. 6 is a flow chart of processing performed by a device functioning as a repeater. The device that functions as a repeater performs "abnormality notification determination unit processing" in addition to "error determination unit processing". The error determination unit processing is substantially the same as the error determination unit processing performed by the device functioning as a terminal shown in FIG. However, there are some differences, so they will be explained below.

It should be noted that the start time of the flow chart is immediately after the steps (1-1) to (1-3) are performed and the grand master is determined.

(Processing of error judgment unit in repeater)
In step S401, the value of the correction integrated value α possessed by the error determination unit 304 is cleared to 0.

In step S402, it is determined whether or not the receiving unit 301 has received the Sync message from the outside. If received (in the case of Yes), the process proceeds to step S403. If it is not received (No), the process proceeds to step S411 included in the "abnormality notification determination unit processing" described later.

In step S403, it is determined whether or not to correct the time from the Sync message received by the time correction unit 303 via the reception unit 301. If there is time correction (yes), the process proceeds to step S404. If there is no time correction (No), the process returns to step S402. The case where there is no time correction is when the correction amount Δ = 0.

In step S404, the time of the repeater 30 is corrected by the correction amount Δ. That is, the time is synchronized with the grand master. Regarding the positive and negative values of Δ, the one that advances the time of the repeater 30 is a positive value, and the one that returns the time of the repeater 30 is a negative value.

In step S405, the correction amount Δ is added to the correction integrated value α included in the error determination unit 304.

In step S406, the error determination unit 304 compares the absolute value of the correction integrated value α with the predetermined threshold value β. When | α |> β (in the case of Yes), the process proceeds to step S413 included in the “abnormality notification determination unit processing” described later. If | α | ≦ β (if No), the process returns to step S402.

The value of the predetermined threshold value β may be a fixed value.

Further, the value of the predetermined threshold value β may be a value based on the clock error (jitter) of the clock 305. The clock of the repeater 30 that is not the grandmaster should be less accurate than the clock of the grandmaster. This is because, as described above, the grand master is determined according to the above procedures (1-1) to (1-3) using BMCA, and the accuracy of the grand master clock should be the highest. Therefore, if the clock of the grand master is normal, it is considered that an error larger than the clock error (jitter) of the clock 305 does not occur. For example, the threshold value β may be a value that is N times the clock error (N is an integer of 1 or more).

(Direction of Grandmaster error notification message)
Although the explanation based on FIG. 6 is in the middle, the direction in which the abnormality notification (Grandmaster abnormality notification message) flows will be described here based on FIG. 7. After that, "abnormality notification determination unit processing", which is the right part of FIG. 6, will be described.

FIG. 7 is a diagram showing the flow direction of the grand master abnormality notification message. The network configuration and existing entities are the same as in FIG. 1, which shows an example network configuration. The difference from FIG. 1 is the direction of the arrow, and the arrow shown in FIG. 7 indicates the direction in which the grandmaster abnormality notification message flows.

It should be noted that, based on FIG. 1, the network 100 has a master / slave structure as described above. The grand master abnormality notification message flows from the slave-side device to the master-side device in the opposite direction to the above-mentioned sync message. The grand master abnormality notification message is not sent from the device 111 that functions as an adjacent repeater to the device 101 that functions as a grand master. This means that when the grandmaster abnormality notification message reaches the device 111 that functions as the adjacent repeater, the device 111 that functions as the adjacent repeater can determine whether or not to perform the grandmaster redetermination process. Because.

(Abnormal notification judgment unit processing)
Next, the flow of "abnormality notification determination unit processing", which is the right side portion of FIG. 6, will be described. The abnormality notification determination unit processing is a processing mainly performed by the abnormality notification determination unit 306.

In step S411, it is determined whether or not the repeater 30 has received the abnormality notification (grand master abnormality notification message). If it is received (in the case of Yes), the process proceeds to step S412, and if it is not received (in the case of No), the process returns to step S402.

In step S411, the determination conditions different from the above can be set. The source of the abnormality notification (“Grandmaster abnormality notification message”) is a device under the control of the repeater 30 (FIG. 7). Here, under the repeater 30, a plurality of devices may exist as slave-side devices. Therefore, step S411 may branch to step S412 when an abnormality notification is received from at least one of the subordinate devices. Further, in another aspect, when an abnormality notification is received from a majority of the subordinate devices, the process may be branched to step S412. In still another aspect, when an abnormality notification is received from all the devices under the control, the process may branch to step S412.

Next, the fact that the repeater 30 receives the abnormality notification (grand master abnormality notification message) (step S411) means that the subordinate device (slave side device) of the repeater 30 has detected the abnormality of the clock master. means. Therefore, in step S412, information indicating that the subordinate device of the repeater 30 has detected an abnormality is saved. The information to be saved may be, but is not limited to, the content of the received Grandmaster abnormality notification message itself. Further, the storage destination of the information may be the storage means as long as the abnormality notification determination unit 306 has the storage means, and the storage means used by the entire repeater 30 may be the storage destination. Note that this information storage may be performed by setting a flag in the time synchronization program being executed by the repeater 30.

Step S413 is a process performed when the error determination unit 304 compares the absolute value of the correction integrated value α with the predetermined threshold value β in step S406 (error determination unit processing), and | α |> β. The fact that the absolute value of the correction integrated value α exceeds the threshold value β means that the repeater 30 itself has detected an abnormality in the grand master. Therefore, in step S413, information indicating that the repeater 30 itself has detected an abnormality is saved. The information to be saved and the storage destination of the information may be the same as in step S412 above. In step S413, the value of the correction integrated value α of the error determination unit 304 may be cleared to 0 after the above processing is completed. However, it is not necessary to clear the value of the correction integrated value α to 0 at this timing.

Next, in step S414, the abnormality notification determination unit 306 determines whether or not both the subordinate device of the own device (repeater 30) and the own device (repeater 30) itself have detected an abnormality. This determination can be made based on the information stored in the preceding steps S412 and S413. If both the subordinate device of the own device (repeater 30) and the own device (repeater 30) itself detect an abnormality (in the case of Yes), the process proceeds to step S415, and in other cases (in the case of No). Returns to step S402.

Step S415 determines whether or not the repeater 30 is a repeater adjacent to the grand master. If the repeater is adjacent to the grand master (in the case of Yes), it is assumed that the current grand master has an abnormality, and the grand master redetermination process is triggered (step S416). If the repeater 30 is not a repeater adjacent to the grand master (No), the adjacent repeater exists on the network, so the process proceeds to step S417 for notifying the abnormality.

Finally, in step S417, the repeater 30 notifies the abnormality. More specifically, the "grand master abnormality notification message sent from the abnormality notification determination unit 306 to the transmission unit 302 is transmitted as an Ethernet packet. Then, the process returns to S401.

When performing the grand master re-determination process, the next grand master may be determined in a state where the device that has been determined to have an abnormality and has functioned as the previous grand master is excluded. There are several possible ways to exclude this.

For example, in (1-1) in the above-mentioned grand master determination process, the own device broadcasts an Announce message on the network. Therefore, when the device 101 functioning as the previous grand master broadcasts the Announce message, if the device 111 functioning as the adjacent repeater blocks the relay of this message, the device 101 is selected again as the grand master. No (see Figure 1).

In addition, each device on the network may hold information indicating that an abnormality has occurred in the device 101, and make a judgment in consideration of this. For example, in (1-2) above, when the Unknown message with higher accuracy than the own device is received, the broadcast of the Unknown message of the own device is stopped. Here, if the own device ignores the Unknown message from the device 101, the broadcast of the Unknown message of the own device can be continued. Therefore, the next grand master can be determined while eliminating the influence of the Announce message from the device 101.

As described above, in the time synchronization system of the present disclosure, the device functioning as a terminal performs the error determination unit processing and detects the abnormality of the grand master. Similarly, the device that functions as a repeater also performs error determination processing to detect an abnormality in the grand master. Furthermore, the device that functions as a repeater performs abnormality notification determination unit processing, and determines whether or not there is an abnormality in the grand master, taking into account whether or not the subordinate device (terminal / repeater) has detected an abnormality in the grand master. To do. With such a configuration, it is possible to detect not a local abnormality but an abnormality in the entire network for time synchronization. Further, the presence or absence of an abnormality in the grand master is determined by coordinating devices other than the device that functions as the grand master as described above.

Then, when the adjacent repeater adjacent to the grand master determines that the grand master has an abnormality, it considers this as an abnormality of the entire network and triggers the grand master redetermination process. In other words, it is not the device that is functioning as the grandmaster, but the adjacent repeater that is adjacent to the device that is functioning as the grandmaster, that ultimately determines the need for the redetermination process of the grandmaster. .. With the above configuration, even if a device functioning as a grand master fails or is infected with a virus and the judgment by this device is doubtful, the grand master can be appropriately redetermined.

In addition, the adjacent repeater does not independently determine the necessity of the grandmaster redetermination process. As described above, the adjacent repeater determines whether or not there is an abnormality in the grand master, taking into consideration whether or not the subordinate device (terminal / repeater) has detected an abnormality in the grand master. Therefore, the safety of the system is ensured even if the adjacent repeater itself has a failure or the like.

With reference to the example of FIG. 1 again, the repeater adjacent to the device 101, which is a terminal, which functions as a grand master, is only one of the devices 111, which functions as an adjacent repeater. However, although not shown, when the repeater functions as a grand master, there may be a plurality of repeaters adjacent to the grand master. In such a case, there are several possible patterns of conditions for triggering the grandmaster redetermination process.

The first pattern is a pattern in which the redetermination process of the grand master is triggered when one of the plurality of adjacent repeaters determines that the current grand master has an abnormality. The processing flow in this case is as described above based on FIG. 6 (see steps S414 and S415).

The second pattern is a pattern in which the redetermination process of the grand master is triggered when the majority of the plurality of adjacent repeaters determines that the current grand master has an abnormality. The third pattern is a pattern in which the redetermination process of the grand master is triggered when all of the plurality of adjacent repeaters determine that the current grand master has an abnormality.

In either pattern, the adjacent repeater that determines that the current grandmaster is abnormal may send a message on the network indicating that the grandmaster should be determined again. In this case, any processor existing in the network may aggregate this message and trigger the grandmaster redetermination process.

FIG. 8 is a sequence diagram showing a basic example of a situation in which the grandmaster redetermination process is triggered in the time synchronization system of the present disclosure. This sequence diagram is shown under the precondition that there is only one adjacent repeater 30 adjacent to the Grandmaster GM, and there is only one subordinate terminal 20 under the adjacent repeater 30. There is. In addition, since information processing performed separately in a plurality of different devices is included, the time series of processing may actually be mixed up. For example, the threshold value determination (time T7) by the repeater 30 and the threshold value determination (time T8) by the terminal 20 may be reversed in the front-rear direction due to the influence of the processing specifications of the device.

At time T1, the Grandmaster GM issues a Sync message. This Sync message is propagated to the terminal 20 (time T2) via the repeater 30.

The repeater 30 and the terminal 20 perform time correction processing, respectively (time T3, T4). This is a process of synchronizing the clock of the own device with the grand master clock based on the Sync message. The correction amount related to the time correction at this time is Δ1 for the repeater 30 and Δ2 for the terminal 20.

The repeater 30 and the terminal 20 respectively update the correction integrated value α (time T5, T6). In the repeater 30, the correction integrated value α1 = α1 + Δ1 is calculated, and in the terminal 20, the correction integrated value α2 = α2 + Δ2 is calculated.

At time T7, the repeater 30 makes a threshold determination for the threshold β1. At this point, | α1 | ≦ β1 and no additional processing occurs (FIG. 6, step S406).

At time T8, the terminal 20 makes a threshold determination for the threshold β2. At this time, | α2 |> β2, and the correction integrated value α2 exceeds the threshold value β2. Therefore, the terminal 20 transmits a grandmaster abnormality notification message on the network (FIG. 5: step S207). Then, the correction integrated value α2 is cleared to 0 (FIG. 5: step S201).

The repeater 30 that has received the grandmaster abnormality notification message from the subordinate terminal 20 saves the abnormality caused by the subordinate terminal (FIG. 6: step S412).

At time T12, the Grandmaster GM issues a Sync message again. This Sync message is propagated to the terminal 20 (time T13) via the repeater 30.

The repeater 30 and the terminal 20 perform time correction processing (time T14, T15) and update of the correction integrated value (time T16, T17), respectively, in the same manner as described above.

At time T19, the terminal 20 re-determines the threshold value for the threshold value β2. However, since the correction integrated value α2 is cleared to 0 at the above-mentioned time T10, | α2 | ≦ β2 at the time T19. Therefore, no particular additional processing occurs (FIG. 5, step S206).

At time T18, the repeater 30 makes a threshold determination again for the threshold β1. Here, | α1 |> β1, and the correction integrated value α1 exceeds the threshold value β1. Therefore, the repeater 30 stores the abnormality caused by the own device 30 (FIG. 6: step S413).

Then, at time T21, the abnormality caused by the own device 30 and the subordinate terminal 20 is detected. The abnormality is saved at time T20 and T11, respectively.

The above means that in the abnormality notification determination unit 306 of the repeater 30, both the abnormality caused by the own device 30 (abnormality A) and the abnormality caused by the subordinate terminal 20 (abnormality B) are aligned (FIG. 6: step). S414).

Further, the repeater 30 is an adjacent repeater adjacent to the grand master GM (FIG. 6: Step S415).

As a result, at time T22, the repeater 30 determines that there is an abnormality in the grand master and triggers the grand master redetermination process.

As described above, the device that functions as the adjacent repeater is when the correction integrated value α exceeds a predetermined threshold value and receives a grandmaster abnormality notification message from a majority of the devices under its control. May send a message on the network indicating that the grandmaster should be determined again. Further, the device functioning as the adjacent repeater is described when the correction integrated value α exceeds a predetermined threshold value and when the grand master abnormality notification message is received from all the devices under the control. A message may be sent over the network indicating that the grandmaster should be determined again. With the above configuration, the grandmaster re-decision process can be triggered on condition that a majority vote is made by a subordinate device or unanimous.

In the above configuration, one or more devices that function as non-adjacent repeaters that are not adjacent to the device that functions as a grand master are further connected via the network, and the device that functions as the non-adjacent repeater is ground. When the time of the own device is corrected based on the master clock, the correction amount of the time is integrated with the correction integrated value α of the own device, and the corrected integrated value α exceeds a predetermined threshold value. Moreover, when the grandmaster abnormality notification message is received from one or more subordinate devices, the grandmaster abnormality notification message may be transmitted on the network. With the above configuration, even if there is a repeater in the network that is not adjacent to the device that functions as the grand master, time synchronization can be performed correctly.

In the above configuration, when a message indicating that the grand master should be determined again is transmitted from one device that functions as an adjacent repeater, the grand master redetermination process may be performed. Further, when a message indicating that the grand master should be determined again is transmitted from the majority of the devices functioning as the adjacent repeaters, the grand master redetermination process may be performed. Further, when a message indicating that the grand master should be determined again is transmitted from all the devices functioning as adjacent repeaters, the redetermination process of the grand master may be performed.

Further, in the grandmaster re-determination process, the device that has functioned as the previous grandmaster may be excluded from the candidates for the grandmaster. With the above configuration, it is possible to prevent the grand master in which the abnormality has occurred from being selected as the grand master again.

Further, a relay device that relays between a device that functions as a ground master and a device that functions as a relay device or a terminal on the network includes a time correction unit, an error determination unit, and an abnormality notification determination unit. The time correction unit corrects the clock of the relay device based on the ground master clock, and the error determination unit integrates the time correction amount by the time correction unit into the correction integrated value α to determine the error. When the correction integrated value α exceeds a predetermined threshold value, the unit notifies the abnormality notification determination unit of the abnormality, and the abnormality notification determination unit notifies the error from the error determination unit and the relay device or the relay device. When both the grand master error notification message from one or more devices functioning as terminals are received, it may be determined that an error has occurred in the grand master. With the above configuration, time synchronization in the network provided with the relay device can be performed without deterioration in accuracy.

In the above configuration, when the abnormality notification determination unit receives both the abnormality notification from the error determination unit and the grandmaster abnormality notification message from the relay device or the majority of devices functioning as terminals, the grandmaster It may be determined that an abnormality has occurred in. Further, when the abnormality notification determination unit receives both the error notification from the error determination unit and the grandmaster abnormality notification message from all the devices functioning as the relay device and the terminal, the abnormality is sent to the grand master. May be determined to have occurred. With the above configuration, it can be determined that an abnormality has occurred in the grand master, subject to a majority vote by the devices under its control or unanimous consent.

In the above configuration, the relay device further includes a transmission unit, and the transmission unit is a case where the abnormality notification determination unit determines that an abnormality has occurred in the grand master, and the relay device serves as the grand master. A grandmaster error notification message may be sent over the network if it is not an adjacent repeater adjacent to a functioning device. Further, the transmission unit is an adjacent repeater adjacent to a device in which the relay device functions as a grand master when the abnormality notification determination unit determines that an abnormality has occurred in the grand master. In this case, a message indicating that the grand master should be determined again may be sent on the network. With the above configuration, the adjacent repeater adjacent to the device functioning as the grand master and the non-adjacent repeater not adjacent to each other can function appropriately and time synchronization can be performed correctly.

In the above configuration, the predetermined threshold value in the device functioning as a repeater may be a value based on the clock error of the device (relay device). With the above configuration, the above-mentioned threshold value β can be set to an appropriate value on the premise that the time accuracy of the grand master is the highest.

In the above configuration, the network may be an in-vehicle network. With the above configuration, time synchronization of devices interconnected by an in-vehicle network can be performed without deterioration in accuracy.

Further, in a method of determining an abnormality of a device functioning as a ground master by a relay device including a time correction unit, an error determination unit, and an abnormality notification determination unit, the relay device is a device that functions as the ground master. And a device that functions as a relay device or a terminal, the time correction unit corrects the clock of the relay device based on the ground master clock, and the error determination unit corrects the clock of the relay device. The amount of time correction by the correction unit is integrated into the correction integration value α, and when the correction integration value α exceeds a predetermined threshold value, the error determination unit notifies the abnormality notification determination unit of the abnormality, and the error determination unit notifies the abnormality. When the notification determination unit receives both the error notification from the error determination unit and the grand master abnormality notification message from the relay device or the device functioning as a terminal, the notification determination unit determines that an error has occurred in the ground master. You may judge. With the above configuration, it is possible to appropriately determine the occurrence of an abnormality in the grand master and perform time synchronization without deterioration in accuracy.

Although various embodiments have been described above with reference to the drawings, it goes without saying that the present invention is not limited to such examples. It is clear that a person skilled in the art can come up with various modifications or modifications within the scope of the claims, which naturally belong to the technical scope of the present invention. Understood. In addition, each component in the above embodiment may be arbitrarily combined as long as the gist of the invention is not deviated.

The present invention can be applied to systems that require precise time synchronization, in addition to in-vehicle devices.

20 Terminal 201 Reception unit 202 Transmission unit 203 Time correction unit 204 Error judgment unit 205 Clock 30 Repeater 301 Reception unit 302 Transmission unit 303 Time correction unit 304 Error judgment unit 305 Clock 306 Abnormality notification judgment unit 100 Network 101 Device 111 Device 112 Device 113 Device 114 Device 115 Device 121 Device 122 Device 123 Device α Correction integrated value α1 Correction integrated value α2 Correction integrated value β Threshold β1 Threshold β2 Threshold Δ Correction amount

Claims (18)

A time synchronization system that synchronizes the clock on the slave side with the grand master clock.
A device that functions as a grandmaster,
One or more devices that function as adjacent repeaters, adjacent to the device that functions as a grandmaster,
One or more devices that function as terminals and
Is connected via the network
The device functioning as the grandmaster transmits a signal including the grandmaster clock over the network.
The device that functions as the terminal
Based on the grand master clock, the time of the device functioning as the terminal is corrected, and the correction amount of the time is integrated with the correction integrated value α possessed by the device functioning as the terminal.
When the correction integrated value α exceeds a predetermined threshold value, a grandmaster abnormality notification message is transmitted on the network.
The device that functions as the adjacent repeater is
The time of the own device is corrected based on the grand master clock, and the correction amount of the time is integrated with the correction integrated value α of the own device.
When the correction integrated value α exceeds a predetermined threshold value and a grand master abnormality notification message is received from one or more subordinate devices, the grand master should be determined again on the network. Send a message indicating that,
Time synchronization system. The time synchronization system according to claim 1.
The device that functions as the adjacent repeater is
When the correction integrated value α exceeds a predetermined threshold value and a grandmaster abnormality notification message is received from a majority of the devices under the control, the grandmaster should be determined again on the network. Send a message indicating
Time synchronization system. The time synchronization system according to claim 1.
The device that functions as the adjacent repeater is
When the correction integrated value α exceeds a predetermined threshold value and when a grandmaster abnormality notification message is received from all the devices under the control, the grandmaster should be determined again on the network. Send a message indicating
Time synchronization system. The time synchronization system according to any one of claims 1 to 3.
One or more devices that function as non-adjacent repeaters that are not adjacent to a device that functions as a grandmaster are further connected via the network.
The device that functions as the non-adjacent repeater
The time of the own device is corrected based on the grand master clock, and the correction amount of the time is integrated with the correction integrated value α of the own device.
When the correction integrated value α exceeds a predetermined threshold value and a grandmaster abnormality notification message is received from one or more subordinate devices, a grandmaster abnormality notification message is transmitted on the network. ,
Time synchronization system. The time synchronization system according to any one of claims 1 to 4.
When a message indicating that the grand master should be determined again is transmitted from one device that functions as an adjacent repeater, the grand master redetermination process is performed.
Time synchronization system. The time synchronization system according to any one of claims 1 to 4.
When a message indicating that the grand master should be determined again is sent from the majority of devices that function as adjacent repeaters, the grand master redetermination process is performed.
Time synchronization system. The time synchronization system according to any one of claims 1 to 4.
When a message indicating that the grand master should be determined again is sent from all the devices functioning as adjacent repeaters, the grand master redetermination process is performed.
Time synchronization system. The time synchronization system according to any one of claims 5 to 7.
In the grandmaster re-determination process, devices that previously functioned as grandmasters are excluded from grandmaster candidates.
Time synchronization system. The time synchronization system according to any one of claims 1 to 8.
In a device that functions as a repeater, the predetermined threshold value is a value based on the clock error of the device.
Time synchronization system. The time synchronization system according to any one of claims 1 to 9.
The network is an in-vehicle network.
Time synchronization system. A relay device that relays between a device that functions as a grand master and a device that functions as a relay device or terminal on a network.
It is equipped with a time correction unit, an error determination unit, and an abnormality notification determination unit.
The time correction unit corrects the clock of the relay device based on the grand master clock.
The error determination unit integrates the time correction amount by the time correction unit into the correction integration value α, and then integrates the time correction amount into the correction integration value α.
When the correction integrated value α exceeds a predetermined threshold value, the error determination unit notifies the abnormality notification determination unit of the abnormality.
When the abnormality notification determination unit receives both the error notification from the error determination unit and the grandmaster abnormality notification message from one or more devices functioning as the relay device or the terminal, the grandmaster has an abnormality. Judge that it is occurring,
Relay device. The relay device according to claim 11.
When the abnormality notification determination unit receives both the error notification from the error determination unit and the grandmaster abnormality notification message from the relay device or the majority of the devices functioning as terminals, an abnormality occurs in the grand master. Judge that you are
Relay device. The relay device according to claim 11.
When the abnormality notification determination unit receives both the error notification from the error determination unit and the grandmaster abnormality notification message from all the devices functioning as the relay device and the terminal, an abnormality occurs in the grand master. Judge that you are
Relay device. The relay device according to any one of claims 11 to 13.
With more transmitter
When the abnormality notification determination unit determines that an abnormality has occurred in the grand master, and the relay device is not an adjacent repeater adjacent to the device functioning as the grand master. , Send a grandmaster error notification message on the network,
Relay device. The relay device according to claim 14, wherein the relay device
When the abnormality notification determination unit determines that an abnormality has occurred in the grand master, and the relay device is an adjacent repeater adjacent to the device functioning as the grand master. , Send a message on the network indicating that the grandmaster should be determined again,
Relay device. The relay device according to any one of claims 11 to 15.
The predetermined threshold value is a value based on the clock error of the relay device.
Relay device. The relay device according to any one of claims 11 to 16.
The network is an in-vehicle network.
Relay device. It is a method of determining an abnormality of a device functioning as a grand master by a relay device including a time correction unit, an error determination unit, and an abnormality notification determination unit.
The relay device may relay between a device that functions as the grand master and a device that functions as a relay device or a terminal.
The time correction unit corrects the clock of the relay device based on the grand master clock.
The error determination unit integrates the time correction amount by the time correction unit into the correction integration value α, and then integrates the time correction amount into the correction integration value α.
When the correction integrated value α exceeds a predetermined threshold value, the error determination unit notifies the abnormality notification determination unit of the abnormality.
When the abnormality notification determination unit receives both the error notification from the error determination unit and the grandmaster abnormality notification message from the relay device or the device functioning as a terminal, an abnormality occurs in the grand master. Judge that
Method.

Images