Method and System for Performing Time-Synchronization

Abstract

A method performs time-synchronization between a master clock and a plurality of slave clocks. The method performs a forward time-synchronization from the master clock to the plurality of slave clocks. Further, the method performs a reverse time-synchronization from the plurality of slave clocks to a corresponding plurality of validator clocks. In addition, the method validates the time-synchronization between the plurality of slave clocks, notably between the master clock and the plurality of slave clocks, based on the plurality of validator clocks.

Claims

1-11. (canceled)

12. A method for performing time-synchronization between a master clock and a plurality of slave clocks, the method comprising: performing a forward time-synchronization from the master clock to the plurality of slave clocks; performing a reverse time-synchronization from the plurality of slave clocks to a corresponding plurality of validator clocks; and validating the time-synchronization between the plurality of slave clocks based on the plurality of validator clocks.

13. The method according to claim 12, wherein the validating is between the master clock and the plurality of slave clocks, based on the plurality of validator clocks.

14. The method according to claim 12, wherein during forward time-synchronization, a slave time of a slave clock is time-synchronized with a master time of the master clock, and/or during reverse time-synchronization, a slave time of a slave clock is time synchronized with a validator time of a corresponding validator clock.

15. The method according to claim 12, wherein forward time-synchronization and/or reverse time-synchronization are performed using PTP protocol.

16. The method according to claim 12, wherein forward time-synchronization and/or reverse time-synchronization are performed over an Ethernet communication network, and forward time-synchronization and reverse time-synchronization make use of different EtherTypes.

17. The method according to claim 12, wherein a message used for reverse time-synchronization has a higher priority with regard to processing and/or transmission than a message used for forward time-synchronization.

18. The method according to claim 12, wherein forward time-synchronization and/or reverse time-synchronization are performed over a communication network, and a validator comprising the plurality of validator clocks has a higher integrity level than at least one or more components of the communication network.

19. The method according to claim 18, wherein the higher integrity level is a higher ASIL level.

20. The method according claim 12, wherein the plurality of validator clocks are implemented in a corresponding plurality of different time domains of a Synchronized Time-Base Manager of a AUTOSAR standard.

21. The method according to claim 12, wherein validating the plurality of slave clocks comprises: comparing validator times of the plurality of validator clocks; validating the plurality of slave clocks, if the validator times of the plurality of validator clocks are time-synchronized; and/or determining that the plurality of slave clocks is not time-synchronized, if the validator times of at least two of the plurality of validator clocks are not time-synchronized,

22. The method according to claim 12, wherein the plurality of slave clocks are associated with a plurality of sensors, and each of the plurality of sensors is configured to provide sensor data with a time stamp generated by the associated slave clock.

23. The method according to claim 22, further comprising: performing a forward time-synchronization from the master clock to a fusion clock of a fusion unit configured to perform sensor fusion of the sensor data provided by the plurality of sensors, wherein the forward time-synchronization from the master clock to the plurality of slave clocks is performed via the fusion unit; and performing a reverse time-synchronization from the fusion clock to a corresponding validator clock.

24. A system for performing time-synchronization between a master clock and a plurality of slave clocks, comprising: a control unit is configured to: perform a forward time-synchronization from the master clock to the plurality of slave clocks; perform a reverse time-synchronization from the plurality of slave clocks to a corresponding plurality of validator clocks; and validate the time-synchronization between the master clock and the plurality of slave clocks based on the plurality of validator clocks.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0025] FIG. 1a shows exemplary components of a vehicle;

[0026] FIG. 1b illustrates the fusion of sensor data in case of time-synchronized environment sensors;

[0027] FIG. 1c illustrates the fusion of sensor data in case of environment sensors having time offsets;

[0028] FIG. 2a shows an example of a time-synchronization system;

[0029] FIG. 2b shows an example of a time-synchronization system with a clock validator; and

[0030] FIG. 3 is a flow chart of an exemplary method for performing time-synchronization.

DETAILED DESCRIPTION OF THE DRAWINGS

[0031] As indicated above, the present document addresses the technical problem of performing time-synchronization at a high level of integrity, notably at a relatively high ASIL (Automotive Safety Integrity Level) Level, e.g. ASIL D. In this context, FIG. 1a shows example components of a vehicle 100. The vehicle 100 comprises different sensors 111, 112 (notably environment sensors) which are configured to capture sensor data. Example sensors 111, 112 are a radar sensor, a camera, a lidar sensor, an ultrasonic sensor, etc.

[0032] A (central) control unit 101 of the vehicle 100 may be configured to perform fusion of the sensor data from the different sensors 111, 112. In particular, the control unit 101 may be configured to determine an environment model of the environment of the vehicle 100 based on the fused sensor data. Furthermore, the control unit 101 may be configured to operate one or more actors 103 (e.g. an engine, a motor, a braking system and/or a steering system) of the vehicle 100 in dependence of the environment model, e.g. in order to provide an autonomous driving mode of the vehicle 100. By way of example, an autonomous longitudinal control and/or lateral control of the vehicle 100 may be performed based on the fused sensor data.

[0033] Each sensor 111, 112 of the vehicle 100 typically comprises a local clock which indicates a local time at the respective sensor 111, 112. The sensor data of the different sensors 111, 112 may be provided with time stamps of the respective local clocks. The quality and/or reliability of the fused sensor data and/or of the environment model typically depends on the time synchronicity of the different local clocks. In particular, time offsets between the different local clocks of the different sensors 111, 112 typically leads to a reduced quality of the fused sensor data. This is illustrated in FIGS. 1b and 1c, which show a vehicle 100 and a static object 120, wherein the object 120 is located at a distance 121 from the vehicle 100.

[0034] FIG. 1b shows a situation, for which the different local clocks are time-synchronized. As a result of this, the position of the vehicle 100 and/or the position of a static object 120, which are indicated by the sensor data of different sensors 111, 112, are similar for all of the different sensors 111, 112. On the other hand, if the local clocks of the different sensors 111, 112 exhibit time offsets with respect to one another, the sensor data of the different sensors 111, 112 may indicate different positions for the vehicle 100 and/or different positions for the static object 120 (see FIG. 1c).

[0035] FIG. 2a shows an example system 200 for synchronizing the local time or the local clocks 213, 214 of different units 203, 204 within a vehicle 100. The system 200 may comprise a plurality of sensor units 204 for a corresponding plurality of sensors 111, 112 of the vehicle 100. Each sensor unit 204 may comprise a local clock 214 which is configured to indicate a local time. Furthermore, the system 200 may comprise a fusion unit 203 which is configured to fuse and/or combine the sensor data provided by the plurality of sensor units 204 (i.e. sensors 111, 112). The fusion unit 203 may comprise a local clock 213 which is configured to indicate a local time.

[0036] The different units 203, 204 may be interconnected through a communication network, notably an Ethernet network, comprising one or more switches 202. Furthermore, the synchronization system 200 comprises a master unit 201 comprising a master clock 211 which is configured to indicate a local time at the master unit 201 (also referred to herein as the master time).

[0037] The master unit 201 may be configured to perform time-synchronization with the fusion unit 203 and with the plurality of sensor units 204. For this purpose, the PTP (Precision Time Protocol) protocol may be used (specified in IEEE 1588). Due to the fact that at least some of the components within the communication network typically exhibit a relatively low integrity level (notably a relatively low ASIL Level or only QM (Quality Management)), the integrity of time-synchronization is relatively low. As a result of this, the time stamps of the sensor data of the different sensors 111, 112 exhibit a relatively low integrity level.

[0038] The distribution of the master time from the master clock 211 to the slave entities 203, 204 or slave clocks 213, 214 may be viewed as a forward time-synchronization 231. As indicated above, the PTP protocol may be used for this forward time-synchronization 231.

[0039] The system 200 may comprise a validator 220, as illustrated in FIG. 2b. The validator 220 may comprise a plurality of time domains 221 with a respective plurality of validator clocks 222. The validator 220 may exhibit a relatively high integrity level (e.g. ASIL D). The system 200 may be configured to perform backward or reverse time-synchronization 232, during which each of the slave clocks 213, 214 and the master clock 211 are time-synchronized with a respective one of the validator clocks 222. The backward or reverse time-synchronization 232 may be performed using the PTP protocol.

[0040] As a result of the backward time-synchronization 232, the validator 220 has access to each slave clock 213, 214 within the system 200 and/or to the master clock 211. In particular, the validator 220 comprises a plurality of validator clocks 222 which are time-synchronized with the corresponding plurality of slave clocks 213, 214. Furthermore, the validator 220 may comprise a validator clock 222 which is time-synchronized with the master clock 211.

[0041] The validator 220 may be configured to compare the different times or time stamps which are indicated by the different validator clocks 222. In particular, the validator 220 may be configured to verify whether the different times which are indicated by the different validator clocks 222 are synchronized or not. If the different times a synchronized, then it may be concluded with a relatively high integrity level (e.g. with ASIL D) that the slave clocks 213, 214 of the system 200 are time-synchronized with each other and/or with the master clock 211. As a result of this, it may be ensured at a relatively high integrity level that the time stamps of the sensor data of the different sensors 111, 112 are time-synchronized.

[0042] The validator 220 may be implemented in an efficient manner as a Synchronized Time-Base Manager of the AUTOSAR standard. In particular, the multiple time domains 221 of a Synchronized Time-Base Manager may be used for providing the different validator clocks 222.

[0043] The validator 220 may form a joint unit with the fusion unit 203. As a result of this, no backward or reverse synchronization 232 needs to be performed with the master clock 211.

[0044] Hence, a forward synchronization and a reverse synchronization between the master clock 211 and the slave clocks 213, 214 may be performed according to the PTP Protocol and according to the AUTOSAR standard (using multiple time domains 221). The time stamps which are generated by the different time domains 221 may be monitored for time corruption and clock synchronization. Furthermore, jitter detection according to the Safety Integrity Level ASIL D may be performed by the validator 220. The time monitoring unit (i.e. the validator 220) may be implemented in a single node or in multiple overlapped distributed nodes.

[0045] For the forward and the reverse synchronization, the PTP Protocol may make use of different EtherTypes for the forward TSync messages and for the reverse TSync messages. By doing this, correct time-synchronization may be ensured within the Ethernet switches 202, as the Ethernet switches will only perform time stamping for forward TSync messages (as specified within the PTP Protocol).

[0046] FIG. 3 shows a flow chart of an example method 300 for performing time-synchronization between a master clock 211 (of a master unit 201) and a plurality of slave clocks 214 (of a corresponding plurality of slave units 204). The plurality of slave clocks 214 may be associated with a corresponding plurality of sensors 111, 112.

[0047] The method 300 comprises performing 301 a forward time-synchronization 231 from the master clock 211 to the plurality of slave clocks 214. The forward time-synchronization 231 may be performed via a communication network (notably via an Ethernet network). The communication network may exhibit (at least partially) a relatively low integrity level (e.g. QM), which may lead to a situation where at least one of the slave clock 214 is not time-synchronized with the master clock 211.

[0048] The method 300 further comprises performing 302 a reverse time-synchronization 232 from the plurality of slave clocks 214 to a corresponding plurality of validator clocks 222 (e.g. via the communication network). The validator clocks 222 may be part of a validator 220, wherein the validator 220 may exhibit a relatively high integrity level (e.g. ASIL D).

[0049] In addition, the method 300 comprises validating 303 the time-synchronization between the plurality of slave clocks 214, notably between the master clock 211 and the plurality of slave clocks 214, based on the plurality of validator clocks 222. For this purpose, the validator times provided by the different validator clocks 222 may be compared. If the validator times are equal and/or time-synchronized, then it may be concluded with a relatively high integrity level (e.g. ASIL D) that the plurality of slave clocks 214 is time-synchronized.

[0050] The synchronization scheme described herein may ensure time synchronization with Safety Integrity Level ASIL D, regardless of the Safety Integrity Level of the Ethernet switches 202 within the communication network. Furthermore, the synchronization scheme described herein may ensure time synchronization with Safety Integrity Level ASIL D, regardless of the Safety Integrity Level of the master clock 211.

[0051] It should be noted that the description and drawings merely illustrate the principles of the proposed methods and systems. Those skilled in the art will be able to implement various arrangements that, although not explicitly described or shown herein, embody the principles of the invention and are included within its spirit and scope. Furthermore, all examples and embodiment outlined in the present document are principally intended expressly to be only for explanatory purposes to help the reader in understanding the principles of the proposed methods and systems. Furthermore, all statements herein providing principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to encompass equivalents thereof