METHOD FOR SYNCHRONIZING A SET OF DEVICES, ASSOCIATED COMPUTER PROGRAM AND SYNCHRONIZATION SYSTEM

Abstract

The invention relates to a method for synchronizing interconnected critical devices comprising servers and clients, each critical device being connected to another critical device by a virtual link, each termination of which is associated with a minimum and a maximum value of transmission time for a data packet, the method, implemented periodically, comprising: the reception of a message at a reception instant, said message comprising at least one time reference determined by a transmitter server, for each message received, the estimation of the current time of the transmitter server on the basis of: the time reference, a value of the internal clock of the current critical device at the current instant and at the reception instant, the minimum value and the maximum value of transmission time of the virtual link between the transmitter server and the current critical device.

Claims

1. A method for synchronizing a set interconnected critical computing devices with a communication network of a vehicle, and each comprising a time management module, the set of critical computing devices comprising at least one plurality of time reference servers, and a plurality of clients, each critical computing device being connected to at least one other critical computing device by a virtual link, each termination point of a virtual link being associated with a minimum value and a maximum value of transmission time for a data packet over the virtual link, the synchronization method being implemented and reiterated periodically by the time management module of each current critical computing device and comprising at least: receiving at least one synchronization message transmitted by a sending server separate from said current critical computing device, each message being associated with a reception instant and comprising at least one time reference determined by the sending server, for each received synchronization message, estimating the current time of the sending server from a quintuplet of parameters comprising: the time reference, a value of the internal clock of the current critical computing device at the current instant, a value of the internal clock of the current critical computing device at the reception instant, and the minimum value and the maximum value of transmission time associated with the virtual link between the sending server and the current critical computing device.

2. The synchronization method according to claim 1, wherein the reiteration period (P) of the method is according to the following relationship: $P<\min \left[\begin{array}{c}\underset{\mathrm{server}.Math..Math.s}{\min }.Math.\left[\frac{\begin{array}{c}{P}_R-\underset{\mathrm{server}.Math..Math.s^{}}{\max }.Math.\left(G\left(s^{},s\right)\right)-\\ \underset{\mathrm{server}.Math..Math.s^{}}{\max }.Math.\left[\mathrm{WCTT}\left(s^{},s\right).Math.\left(D\left(s\right)+D\left(s^{}\right)\right)\right]\end{array}}{M.Math.\left(D\left(s\right)+\underset{\mathrm{server}.Math..Math.s^{}}{\max }.Math.D\left(s^{}\right)\right)}\right],\\ \underset{\mathrm{client}.Math..Math.c,\mathrm{server}.Math..Math.s}{\min }.Math.\left[\frac{P_R-G\left(s,c\right)}{D\left(c\right)+D\left(s\right)}\right]-\mathrm{WCTT}\left(s,c\right)\end{array}\right]$ with: G(s,s) the time difference between the best and worst theoretical transmission times of a packet transmitted in the virtual link between two servers, P.sub.R a precision datum corresponding to the maximum acceptable gap between the time reference of two computer devices, D a maximum drift rate of the internal clock of a critical computing device; and M the number of critical computing devices of said assembly.

3. The synchronization method according to claim 1, wherein each critical computing device also comprises a module for managing synchronization failure(s) that may be detected during the implementation of said method, and in which the method comprises, during a current period, prior to the reception of at least one synchronization message and the estimate of the current time of the sending server: the transmission, by the time management module of the current critical computing device, to its own failure management module, of any information, associated with a module for managing failures of at least one sending server separate from the current critical computing device, and received during the preceding period, and the performance of each action, not yet performed, received from its own failure management module.

4. The synchronization method according to claim 1, the current critical computing device being a current server from the plurality of servers, each server being connected to each other server and each client by a virtual synchronization link, an wherein, during an initialization phase, the method comprises, prior to the reception of at least one synchronization message and the estimate of the current time of the sending server: the determination of a time reference of the current server by applying a predetermined affine function to the value of the internal clock of the current server at the current moment, the affine function being associated with a factor and a shift, the values of which are initiated beforehand at predetermined initial values, and the sending of a synchronization message comprising an identification field representative of the initialization phase of the time management modulo of the current server and comprising the time reference of the current server.

5. The synchronization method according to wherein successively to the estimate of the current time of the sending server carried out, for each received synchronization message comprising an identification field representative of the initialization phase of a separate sending server, and implemented once a first predetermined number of synchronization messages is received, is achieved, the method comprises: determining a new time reference corresponding to the current maximum time obtained from current times associated with each message, updating the factor and the shift of the affine function as a function of said new time reference, and starting the operational phase of the time management module of the current

6. The synchronization method according to claim 4, wherein successively to the estimate of the current time of the sending server carried out, for each received synchronization message comprising an identification field representative of the operational phase of a separate sending server, and implemented once a second predetermined number of synchronization messages is received, is achieved, the method comprises: determining a new time reference corresponding to the current average time obtained from current times associated with each message, updating the factor and the shift of the affine function as a function of said new time reference, and starting the operational phase of the time management module of the current server.

7. The synchronization method according to claim 1, the current critical computing device being a current server from the plurality of servers, each server being connected to each other server and each client by a virtual synchronization link, wherein, during the operational phase, the method comprises: for each received synchronization message comprising an identification field representative of the operational phase of a separate sending server: if the reception instant of the message is more than two periods earlier than the current instant, sending a piece of information representative of an anomaly to the failure management module of the current client and stopping of the processing of the message, otherwise, said estimate of the current time associated with said message, determining a new time reference corresponding to the current average time obtained from the current time of the current server and current times associated with each message, updating the factor and the shift of the affine function as a function of said new time reference, and sending a synchronization message comprising an identification field representative of the operational phase of the current server and containing said time reference of the current server.

8. The synchronization method according to claim 1, the current critical computing device being, a current client from the plurality of clients, each client being connected to each server from the plurality of servers by a virtual synchronization link, wherein, during an initialization phase, successively to the estimate of the current time of the sending server carried out from the first received synchronization message comprising an identification field representative of the operational phase of a separate sending server, the method comprises: updating the time reference of the current client equal to the current time associated with said message, initializing initial factor and shift values of an affine function applicable to the value of the internal clock of the current client, and starting the operational phase of the time management module of the current client.

9. The synchronization method according to claim 1, the current critical computing device being a current client from the plurality of clients, each client being connected to each server from the plurality of servers by a virtual synchronization link, wherein, during an operational phase, the method comprises: for each received synchronization message comprising an identification field representative of the operational phase of a separate sending server: if the reception instant of the message is more than two periods earlier than the current instant, sending a piece of information representative of an anomaly to the failure management module of the current client and stopping of the processing of the message, otherwise, said estimate of the current time associated with said message, if the absolute value of the difference between, on the one hand, a time reference of the current client obtained by applying an affine function to the value of the internal clock of the current client at the current moment, and on the other hand the average current time obtained from current times associated with each message is above a predetermined precision threshold, the sending of information representative of an anomaly to the failure management module of the current client, determining a new time reference corresponding to the current average time obtained current times associated with each message, and updating the factor and the shift of the affine function of the current client as a function of said new time reference.

10. A system for synchronizing a set of interconnected critical computing devices, in particular avionics devices, with a communication network of a vehicle, and each comprising a time management module, the set of critical computing devices comprising at least one plurality of time reference servers, and a plurality of clients, each critical computing device being connected to at least one other critical computing device by a virtual link, each termination point of a virtual link being associated with a minimum value and a maximum value of transmission time for a data packet over said virtual link, the time management module of each current critical computing device being able to carry out and periodically reiterate at least: receiving at least one synchronization message transmitted by a sending server separate from said current critical computing device, each message being associated with a reception instant and comprising at least one time reference determined by said sending server, for each received synchronization message, estimating the current time of the sending server from a quintuplet of parameters comprising: said time reference, a value of the internal clock of the current critical computing device at the current instant, a value of the internal clock of the current critical computing device, at the reception instant, and the minimum value and the maximum value of transmission time associated with the virtual link between the sending server and the current critical computing device.

Description

[0062] These features and advantages of the invention will appear more clearly upon reading the following description, provided solely as a non-limiting example, and done in reference to the appended drawings, in which:

[0063] FIG. 1 is a schematic illustration of a synchronization system according to the invention;

[0064] FIG. 2 is a flowchart of a synchronization method according to a first embodiment of the invention where the computing device implementing the method is a server;

[0065] FIG. 3 is a flowchart of a synchronization method according to a second embodiment of the invention where the computing device implementing the method is a client;

[0066] The synchronization system 10 illustrated in FIG. 1 is for example embedded in an aircraft, not shown. The synchronization system 10 is configured to exchange a time reference between, on the one hand, a plurality of M (M2) critical computing devices corresponding here to avionics devices, called servers 12, such as the three servers S.sub.A, S.sub.B and S.sub.C, and on the other hand a plurality of Q (Q2) critical computing devices, here corresponding to avionics devices, called clients 14 C.sub.1 and C.sub.2.

[0067] In particular, an avionics server 12 or client 14 device is an avionics computer able to execute software, while guaranteeing a strict spatial and temporal partitioning of these software applications. This partitioning is for example implemented by an operating system according to standard ARINC 653.

[0068] According to one particular aspect, a same avionics device is able to operate both as a server 12 (that is to say, to implement the specific steps of the synchronization method associated with the server type of avionics device) and as client 14 (that is to say, to implement the specific steps of the synchronization method associated with the client type of avionics device).

[0069] Servers 12 and clients 14 are connected to a communication network 16, for example an avionics communication network according to standard ARINC A664-p7, and preferably made redundant.

[0070] More specifically, the network 16 comprises a plurality of network switches 17.

[0071] Additionally, according to a predefined and static architecture of the network, the data streams exchanged between the various server or client avionics devices are separated using a strict segregation.

[0072] In particular, for each server 12, for example the server S.sub.A, a dedicated virtual link (VL) 18, said to be for synchronization, connects this server 12, via the network switches 17, to all of the other servers 12 S.sub.B and S.sub.C and all of the clients C.sub.1 and C.sub.2. Such virtual synchronization links 18 are able to transport clock synchronization messages.

[0073] Similarly, for each client 14, for example the client C.sub.1, a dedicated virtual link 20, said to be for control, connects this client 14 to all of the servers 12 S.sub.A, S.sub.B and S.sub.C.

[0074] In particular, via such a virtual control link, each client 14 is able to request the restart of the synchronization method according to the invention, or the reset of the shared time reference. Associated with each of these commands is the instant, according to the time reference, where the command must be executed by the servers 12.

[0075] According to one specific aspect, a command is only taken into account by the servers if it is confirmed by the reception of a command of the same type sent by at least one other client in a predefined length of time.

[0076] According to one specific aspect, the virtual synchronization links 18 are configured with a higher priority level than all of the other virtual links implemented by the network 16, in particular the virtual control links 20.

[0077] Additionally, each avionics server 12 or client 14 device contains at least the following elements: an internal clock H.sub.i, a time management module G_H able to carry out the method according to the invention and corresponding to the point of origin and/or respectively the recipient of the virtual synchronization 18 and control 20 links, a failure management module G_P dedicated to managing failures detected during the implementation of the method according to the invention, a network sending module E whose transmission time of a message from the partition (within the meaning of standard ARINC 653) until its sending over the network 16 is known and fixed (no jitter (that is to say, latency variation)), a network receiving module R, in which each received packet is able to be timestamped with the internal clock H.sub.i of the avionics device, once it is received by the input port connected to the network 16 A664-p7.

[0078] The time management G_H and failure management G_P modules are for example implemented, in each of the servers 12 or client 14, by software hosted in one or several partition (s).

[0079] In a variant, all or some of the time management G_H and failure management G_P modules are able to be implemented using one or several programmable logic circuit(s), such as an FPGA (Field Programmable Gate Array), or in the form of a dedicated integrated circuit, such as an ASIC (Application Specific Integrated Circuit) mounted on an electronic board embedded in the avionics device in question.

[0080] According to the present invention, a message sent over a virtual synchronization link 18 in particular comprises four separate fields, namely: [0081] a field dedicated to a version number of the protocol for example corresponding to an integer over four bits, [0082] an identification field of the message type depending on whether the synchronization method implemented in the considered avionics device is in the initialization phase INIT or in the operational phase TIME, encoded for example by an integer over four bits, [0083] a notification field sent by the failure management module of the sending server, for example S.sub.B, to the failure management module of each of the other servers, for example the servers S.sub.A and S.sub.C, such a field being able to assume a nil value representative of the absence of notification, or any other value depending on the internal operation of the failure management modules representative of the first notification sent by the failure management module and not yet transmitted over said virtual synchronization link 18, encoded for example by an integer over a byte, and [0084] a field dedicated to the insertion of the time reference Href calculated by the server that sends the message, for example the time reference Href.sub.B calculated by the server S.sub.B, encoded for example by an integer over eight bytes indicating the number of microseconds elapsed since the reset of this counter.

[0085] During the design of the communication network 16, a configuration platform 22 is able to determine, for each termination point (that is to say, a server 12 or a client 14) of a virtual synchronization link 18, the best BCTT and worst WCTT theoretical transmission times of a packet received in the virtual link in question between two avionics devices, whether it is a pair of two servers or pair comprising a server and a client.

[0086] These parameters BCTT and WCTT associated with a given virtual link 18 as well as other predetermined configuration data are integrated into the configuration files of each avionics device of the embedded synchronization system 10 and/or in a file stored within the configuration platform 22. The other configuration data in particular include: the number N of servers 12 necessary to guarantee the robustness of the time reference determined and shared within the ARINC A664-p7 network 16, a maximum drift level D of the internal clock H.sub.i of a considered avionics device 12 or 14 relative to an exact theoretical time (this level is a characteristic datum of the electronic components implanted in the avionics device), a precision datum P.sub.R corresponding to the maximum acceptable gap between the time reference of two clients, for example, or the predetermined value of the synchronization period P, the method according to the invention being implemented periodically according to this period P by each time management module G_H whether it is comprised in an avionics device corresponding to a server 12 or to a client 14, etc.

[0087] In particular, in order to guarantee the reliability of the value of the precision datum P.sub.R, the configuration platform 22 is able to verify that the period P is according to the following relationship:

[00002]$P<\min \left[\begin{array}{c}\underset{\mathrm{server}.Math..Math.s}{\min }.Math.\left[\frac{\begin{array}{c}{P}_R-\underset{\mathrm{server}.Math..Math.s^{}}{\max }.Math.\left(G\left(s^{},s\right)\right)-\\ \underset{\mathrm{server}.Math..Math.s^{}}{\max }.Math.\left[\mathrm{WCTT}\left(s^{},s\right).Math.\left(D\left(s\right)+D\left(s^{}\right)\right)\right]\end{array}}{M.Math.\left(D\left(s\right)+\underset{\mathrm{server}.Math..Math.s^{}}{\max }.Math.D\left(s^{}\right)\right)}\right],\\ \underset{\mathrm{client}.Math..Math.c,\mathrm{server}.Math..Math.s}{\min }.Math.\left[\frac{P_R-G\left(s,c\right)}{D\left(c\right)+D\left(s\right)}\right]-\mathrm{WCTT}\left(s,c\right)\end{array}\right]$

with G(s,s) the time difference between the best (BCTT) and worst (WCTT) theoretical transmission times of a packet transmitted in the virtual link by a server s toward a server s.

[0088] Furthermore, each time management module G_H is able to detect a synchronization anomaly, for example a difference between its own time reference and that of another server that is too great to guarantee the precision P.sub.R, and to report it to the failure management module G_P of the avionics device to which the time management G_H and failure management G_P modules both belong.

[0089] In response, the failure management module G_P is able to indicate, to the time management module G_H, a sequence of actions to be executed in reaction to this synchronization anomaly. The correspondence between the detected type of synchronization anomaly and the sequence of actions to be executed is also a configuration datum able to be stored in a configuration file of each considered avionics device and depends on the security architecture of the overall critical computing system and the use(s) of the time reference.

[0090] Such an action is for example restarting the time management module G_H, or the broadcasting, by the time management module G_H, of a piece of information representative of this anomaly, also called notification, to the other servers 12, or the exclusion of a server 12 to be taken into account in order to carry out the synchronization method according to the invention, or the stopping of the implementation of the synchronization method according to the invention, etc.

[0091] The synchronization method implemented by each avionics device, server 12 or client 14, of the synchronization system 10 of FIG. 1 will now be described in more detail in reference to FIG. 2 when the avionics device is a server 12, and in reference to FIG. 3 when the avionics device is a client 14.

[0092] As disclosed hereinafter in relation with FIG. 2 or FIG. 3, whether the avionics device is a server 12 or client 14, these two types of avionics devices of the synchronization system 10 both periodically implement two essential steps, namely a step for receiving at least one synchronization message transmitted by a sending server 12 (for example S.sub.B) separate from the current critical computing device (server 12, for example S.sub.A, or client 14, for example C.sub.1), each message being associated with a reception instant ti with i the index of the sending server and comprising at least one time reference Href.sub.B determined by the sending server (for example S.sub.B), and for each received synchronization message, a step for estimating the current time Hc.sub.i of the sending server (for example S.sub.B) from a quintuplet of parameters comprising: [0093] the time reference Href.sub.i with i the index of the sending server, for example Href.sub.B for the sending server S.sub.B. [0094] a value h.sub.int.sub._.sub.tc.sub._.sub.di of the internal clock of the current critical computing device di at the current instant tc, the current instant tc being able to increase over the time that elapses and corresponding to the current implementation instant of a step of the method according to the invention. [0095] a value h.sub.int.sub._.sub.ti.sub._.sub.di of the internal clock of the current critical computing device di at the reception instant ti, [0096] the minimum value BCTT(S.sub.i, d.sub.i) and the maximum value WCTT(S.sub.i, d.sub.i) of transmission time associated with the virtual link VL between the sending server S.sub.i, for example the sending server S.sub.B, and the current critical computing device d.sub.i.

[0097] Additionally, whether the avionics device is a server 12 or a client 14, these two types of avionics device of the synchronization system 10 implement, during a current period, before receiving at least one synchronization message and upon estimating the current time Hc.sub.B of the sending server S.sub.B: [0098] the transmission, by the time management module of the current critical computing device, to its own failure management module G_P, of any information, associated with a module for managing failures G_P of at least one sending server separate from the current critical computing device, and received during the preceding period, [0099] the performance of each action, not yet performed, received from its own failure management module G_P.

[0100] In other words, the present invention takes advantage of specific features of critical partitioned systems, namely the predefined and static configuration of the communication network 16, the strict segregation of the data streams exchanged within this communication network 16, and the master of the network crossing times using the theoretical calculation implementing during the design of the network 16 to determine the crossing time of a data packet of a virtual link 18, which makes it possible to avoid the use of statistical methods, such as, for example, those associated with the PTP protocol (Precision Time Protocol) (IEEE 1588), which are unsuitable for critical computing systems such as avionics systems, also using a segregation of the streams within an A664-P7 network, since the precision of the time cannot be formally guaranteed due to the statistical approach used.

[0101] Additionally, the present invention is based on the use of a plurality of servers able to define a precise common time reference, which makes the synchronization implemented according to the invention robust.

[0102] Indeed, the use of a single server is not suitable for determining a time reference usable for a critical computing function such as an avionics function.

[0103] Additionally, the present invention makes it possible to avoid altering the operation of the network switches 17, which makes it possible to carry out the method according to the invention within existing communication networks 16.

[0104] In relation with FIG. 2, the synchronization method 24 implemented when the avionics device corresponds to a server 12 is disclosed hereinafter.

[0105] Such a synchronization method 24 implemented by the server comprises two phases, namely an initialization phase 26 and an operational phase 28.

[0106] In the initialization phase 26, the synchronization method 24 implemented by a current server 12, for example S.sub.A, comprises a first step 30 for initializing parameters of a predetermined affine function in order to obtain the reference time Href associated with the server 12 S.sub.A.

[0107] In particular, for each server S.sub.i, these parameters correspond to a factor coeff.sub.si initialized at one and an offset offset.sub.si initialized opposite the internal clock value with the initialization instant h.sub.int.sub._.sub.tinit.sub._.sub.Si.

[0108] Then for each period P, according to a step 32, the time management module G_H of the current server S.sub.A implements the transmission to its own failure management module G_P of any information (that is to say, notification or notification field), associated with a failure management module G_P of at least one sending server separate from the current server S.sub.A, and received during the previous period.

[0109] As previously indicated, this step 32 is followed by step 34 for performing each action, not yet performed, received from its own failure management module G_P.

[0110] Once these steps 30 to 34 have been performed, the server in the initialization phase 26 carries out a step 36 for determining the time reference Href.sub.A of the current server S.sub.A by applying the predetermined affine function to the value of the internal clock of the current server at the current moment t.sub.c, such that:

Href.sub.A(t.sub.c)=coeff.sub.A.Math.h.sub.int.sub._.sub.tc.sub._.sub.SA+Offset.sub.A=h.sub.int.sub._.sub.tc.sub._.sub.SAh.sub.int.sub._.sub.tinit.

[0111] According to step 36, the current server S.sub.A next sends a synchronization message comprising an identification field representative of the initialization phase of the time management module of the current server S.sub.A, namely for example INIT, and comprising the time reference of the current server S.sub.A, that is to say Href.sub.A.

[0112] Then, two variants of the initialization phase are carried out depending on the type of synchronization message received, INIT or TIME, and as a function of the number of synchronization messages, in other words as a function of the number of separate servers sending a synchronization message.

[0113] According to a first variant, if, according to a step 38, the current server S.sub.A has received at least one message INIT from at least (N1) separate servers since the entry into the initialization phase 26, then for each last message INIT received from separate servers (message received from the server S.sub.i for example corresponding to S.sub.B or S.sub.C, at the instant t.sub.i, and containing the time reference Href.sub.i), the time management module of the current server S.sub.A, according to a step 40, carries out the estimate of the current time of the sending server, for example S.sub.B, according to the following equation of the current incident t.sub.c:

Hc.sub.B=Href.sub.B+h.sub.int.sub._.sub.tc.sub._.sub.SAh.sub.int.sub._.sub.ti.sub._.sub.SA+(BCTT(S.sub.B,S.sub.A)+WCTT(S.sub.B,S.sub.A))/2.

[0114] Then this step 40 is followed by a step 42 for determining the maximum value among the current times of the estimated sending servers, for example in relation with FIG. 1, the maximum value Hmax of the current times Hc.sub.B and Hc.sub.C respectively associated with the sending servers S.sub.B and S.sub.C.

[0115] The following step 44 serves to use the value Hmax as new time reference NHref.sub.A associated with the server S.sub.A. To that end, during this step 44, the time management module implements the update (that is to say, correction) of the new parameters Ncoeff.sub.A and Noffset.sub.A of the affine function associated with the server S.sub.A according to the following equations and to be sued during the following period P:

Ncoeff.sub.A=1+(NHref.sub.AHref.sub.A)/P, et Noffset.sub.A=offset.sub.A+(coeff.sub.ANcoeff.sub.A).Math.h.sub.int.sub._.sub.tc.sub._.sub.SA.

[0116] Once this step 44 is implemented, the operational phase 28 is started in the following period P.

[0117] According to a second variant, if, according to a step 46, the current server S.sub.A has received at least one message TIME (that is to say, representative of the operational phase 28) from at least N separate servers since the entry into the initialization phase 26, then for each last message TIME received from separate servers (message received from the server S.sub.i for example corresponding to S.sub.B or S.sub.C, at the instant t.sub.i, and containing the time reference Href.sub.i), the time management module of the current server S.sub.A, according to a step 48, carries out the estimate of the current time of the sending server, for example S.sub.B, according to the following equation of the current incident t.sub.c:

Hc.sub.B=Href.sub.B+h.sub.int.sub._ .sub.tc.sub._.sub.SAh.sub.int.sub._.sub.ti.sub._.sub.SA+(BCTT(S.sub.B,S.sub.A)+WCTT(S.sub.B,S.sub.A))/2,

otherwise steps 32 to 38 of the method previously disclosed are reiterated in the following period P, until the condition of step 38 is satisfied, namely the reception of at least one message INIT from at least (N1) separate servers from the entry into the initialization phase 26, or while the condition associated with step 46, namely the reception of at least one message TIME (that is to say, representative of the operational phase 28) from at least N separate servers from the entry into the initialization phase 26.

[0118] Then this step 48 is followed by a step 50 for determining the average value of the current times of the estimated sending servers, for example in relation with FIG. 1, the average value Hmoy.sub.s of the current times Hc.sub.B and Hc.sub.c respectively associated with the sending servers S.sub.B and S.sub.C.

[0119] The following step 52 serves to use the value Hmoy.sub.s as new time reference NHref.sub.A associated with the server S.sub.A. To that end, during this step 52, the time management module implements the update (that is to say, correction) of the new parameters Ncoeff.sub.A and Noffset.sub.A of the affine function associated with the server S.sub.A according to the following equations and to be sued during the following period P:

Ncoeff.sub.A=1+(NHref.sub.AHref.sub.A)/P, et Noffset.sub.A=offset.sub.A+(coeff.sub.ANcoeff.sub.A).Math.h.sub.int.sub._.sub.tc.sub._.sub.SA.

[0120] Once this step 52 is implemented, the operational phase 28 is started in the following period P.

[0121] When the current server S.sub.A is in the operational phase 28, in each period P, the synchronization method comprises a step 54, during which the time management module G_H of the current server S.sub.A implements the transmission to its own failure management module G_P of any information (that is to say, notification or notification field), associated with a failure management module G_P of at least one sending server separate from the current server S.sub.A, and received during the previous period.

[0122] As previously indicated, this step 54 is followed by step 56 for performing each action, not yet performed, received from its own failure management module G_P.

[0123] Then according to a step 58, for each last message TIME received from separate servers (message received from the server S.sub.i for example corresponding to S.sub.B or S.sub.C, at the instant t.sub.i, and containing the time reference Href.sub.i), the time management module of the current server S.sub.A in the operational phase 28 implements: [0124] if the reception instant of the message is more than two periods earlier than the current instant, sending a piece of information representative of an anomaly to the failure management module of the current client and stopping of the processing of the received message TIME, [0125] otherwise the estimate of the current time of the sending server, for example S.sub.B according to the following equation at the current instant t.sub.c:

Hc.sub.B=Href.sub.B+h.sub.int.sub._.sub.tc.sub._.sub.SAh.sub.int.sub._.sub.ti.sub._.sub.SA+(BCTT(S.sub.B,S.sub.A)+WCTT(S.sub.B,S.sub.A))/2.

[0126] Then this step 58 is followed by a step 60 for determining the average value of h.sub.int.sub._.sub.tc.sub._.sub.SA and of the current times of the estimated sending servers, for example in relation with FIG. 1, the average value Hmoy.sub.s of h.sub.int.sub._.sub.tc.sub._.sub.SA and the current times Hc.sub.B and Hc.sub.C respectively associated with the sending servers S.sub.B and S.sub.C.

[0127] The following step 62 serves to use the value Hmoy.sub.s as new time reference NHref.sub.A associated with the server S.sub.A. To that end, during this step 62, the time management module implements the update (that is to say, correction) of the new parameters Ncoeff.sub.A and Noffset.sub.A of the affine function associated with the server S.sub.A according to the following equations and to be sued during the following period P:

Ncoeff.sub.A=1+(NHref.sub.AHref.sub.A)/P, et Noffset.sub.A=offset.sub.A+(coeff.sub.ANcoeff.sub.A).Math.h.sub.int.sub._.sub.tc.sub._.sub.SA.

[0128] Once this step 62 is carried out, a step 64 for sending of a synchronization message comprising an identification field TIME representative of the operational phase of the current server and containing the new time reference NHref.sub.A associated with the server S.sub.A is carried out.

[0129] In relation with FIG. 3, the synchronization method 66 implemented when the avionics device corresponds to a client 14 is disclosed hereinafter.

[0130] Such a synchronization method 66 implemented by the client also comprises two phases, namely an initialization phase 68 and an operational phase 70.

[0131] In the initialization phase 68, in each period P, the synchronization method 66 carried out by a current client 14, for example C.sub.1, comprises a first step 72 in which the time management module G_H of the current client C.sub.1 carries out the transmission to its own failure management module G_P, of any information (that is to say, notification or notification field), associated with a failure management module G_P of at least one sending server, and received during the preceding period.

[0132] As previously indicated, this step 72 is followed by step 74 for performing each action, not yet performed, received from its own failure management module G_P.

[0133] Then according to a step 76, if a first message TIME (that is to say, representative of the operational phase 28 of a sending server) is received from a server (message received from the server S.sub.i for example corresponding to S.sub.A, S.sub.B or S.sub.C, at the instant t.sub.i, and containing the time reference Href.sub.i), the time management module of the current client C1 carries out, according to a step 78, the estimate of the current time of the sending server, for example S.sub.B, according to the following equation at the current instant t.sub.c:

[0134] Hc.sub.B=Href.sub.B+h.sub.int.sub._.sub.tc.sub._.sub.C1h.sub.int.sub._.sub.ti.sub._.sub.C1+(BCTT(S.sub.B,C.sub.1)+WCTT(S.sub.B,C.sub.1))/2, otherwise steps 72 and 74 for transmitting notification information and action performance are reiterated in the following period P, until a message TIME is received.

[0135] The value Hc.sub.B is then selected by the current client C.sub.1, according to a step 80, as its new time reference H.sub.C1=Hc.sub.B. To that end, during this step 80, the time management module implements the initialization of parameters of the affine function applicable to the value of the internal clock of the current client C.sub.1. These parameters correspond to a factor coeff.sub.C1 initialized at one and an offset offset.sub.C1 initialized in the form: offset.sub.C1=H.sub.C1h.sub.int.sub._.sub.tc.sub._.sub.C1 at the current instant tc of implementation of the initialization step 80.

[0136] Once this step 80 is implemented, the operational phase 70 is started in the following period P.

[0137] In the operational phase 70 of the current client, the method 66 then comprises, in each period P, a first step 82 in which the time management module G_H of the current client C.sub.1 carries out the transmission to its own failure management module G_P, of any information (that is to say, notification or notification field), associated with a failure management module G_P of at least one sending server, and received during the preceding period.

[0138] As previously indicated, this step 82 is followed by step 84 for performing each action, not yet performed, received from its own failure management module G_P.

[0139] Then, for each last message TIME received by the current client, for example C.sub.1, from separate servers (message received from the server Si for example corresponding to S.sub.A, S.sub.B or S.sub.C, at the instant t.sub.i, and containing the time reference Href.sub.i), according to a step 86, if the reception instant t, of the message is more than two periods P before the current instant t.sub.c (in other words if t.sub.ct.sub.i>2P), the sending of information representative of an anomaly to the failure management module of the current client and the stopping of the processing of this message is implemented.

[0140] Otherwise, the time management module of the current client C.sub.1 implements, according to a step 90, the estimate of the current time of the sending server, for example S.sub.B according to the following equation at the current instant t.sub.c:

Hc.sub.B=Href.sub.B+h.sub.int.sub._.sub.tc.sub._.sub.C1h.sub.int.sub._.sub.ti.sub._.sub.C1+(BCTT(S.sub.B,C.sub.1)+WCTT(S.sub.B,C.sub.1))/2.

[0141] Then, according to a step 92, the time management module of the current client C.sub.1 implements the determination of the average value Hmoy.sub.c of the current times Hc.sub.A, Hc.sub.B and Hc.sub.C respectively associated with the sending servers S.sub.A, S.sub.B and S.sub.C.

[0142] According to a step 94, if the absolute value of the difference between, on the one hand, the time reference Href.sub.C1 of the current client obtained by applying an affine function to the value of the internal clock h.sub.int.sub._.sub.tc.sub._.sub.C1 of the current client C.sub.1 at the current moment t.sub.c, and on the other hand the average current time Hmoy.sub.c is above a predetermined threshold corresponding to the precision datum P.sub.R of the configuration file of the considered current client, for example C.sub.1, while the sending of a piece of information representative of an anomaly (i.e., failure) to the failure management module G_P of the current client C.sub.1 is implemented.

[0143] In other words, with Href.sub.C1=coeff.sub.C1.Math.h.sub.int.sub._.sub.tc.sub._.sub.C1+OffSet.sub.C1, if |Hmoy.sub.CHref.sub.C1|>P.sub.R, then a failure is indicated by the time management module G_H of the current client C.sub.1 to its own failure management module G_P.

[0144] Then, according to step 96, the new time reference of the current client C.sub.1 NHref.sub.C1 then corresponds to the average current time Hmoy.sub.C and the update of new values of the parameters Ncoeff.sub.C1 and Noffset.sub.C1 of the affine function associated with the current client C.sub.1 is implemented according to the following equations and to be used during the following period P:

Ncoeff.sub.C1=1+(NHref.sub.C1Href.sub.C1)/P, et Noffset.sub.C1=offset.sub.C1+(coeff.sub.C1Ncoeff.sub.C1).Math.h.sub.int.sub._.sub.tc.sub._.sub.C1.

[0145] Thus, the synchronization system according to the present invention implements a plurality of servers 12 that define a common precise time. This common time is next sent to the clients 14. The system according to the present invention does not require any specific function of the network switches, which allows both the conservation of the existing network(s), with no hardware or software impact on the network equipment already installed, and improved integrity of the networks, while monitoring the crossing time of the messages.