Very high-precision clock module controlled by a reference signal and comprising a system for checking phase integrity

Abstract

A clock module includes a main precision oscillator generating a first clock signal of a predetermined frequency, a receiving module receiving a time reference and providing a time reference signal controlling the main oscillator, and a detector for detecting a failure of the main oscillator or of the time reference signal. The detector includes: a second oscillator not controlled by the clock module and delivering a second clock signal of predetermined frequency; and a processor configured to measure a first phase difference between the first clock signal and the time reference signal, a second phase difference between the first clock signal and the second clock signal, and a third phase difference between the time reference signal and the second clock signal. The processor is configured to calculate calculating drifts of the first order of the three phase differences measured so as to determine respective variations of the three phase differences.

Claims

1. A clock module comprising: a main precision oscillator dedicated to synchronisation and generating a first clock signal of predetermined frequency; a receiver module configured to receive a time reference, and deliver, when active, a time reference signal on which the main precision oscillator is controlled; and a phase detector configured to detect a failure of the main oscillator or of the time reference signal and comprising: a second oscillator not controlled by an electronic component of the clock module and configured to deliver a second clock signal of relatively constant predetermined frequency over a short period, and a processor configured to measure a first phase difference between the first clock signal delivered by the main precision oscillator and the time reference signal delivered by the receiver module, a second phase difference between the first clock signal delivered by the main precision oscillator and the second clock signal delivered by the second oscillator, and a third phase difference between the time reference signal delivered by the receiver module and the second signal delivered by the second oscillator, said processor being configured to calculate drifts of the first order of the first, second and third phase differences measured so as to determine respective variations of the first, second and third phase differences, compare values of the drifts of the first order calculated with a predetermined threshold value and detect a failure of the main precision oscillator in response to the values of the drift of the first order of the first phase difference and of the second phase difference being each greater than said predetermined threshold value, or a failure of the time reference signal in response to the values of the drift of the first phase difference and of the third phase difference being each greater than said predetermined threshold value.

2. The clock module according to claim 1, wherein said processor is further configured to calculate drifts of the second order of the first, second and third phase differences measured and detect a failure of the main precision oscillator in response to the drift of the second order of the third phase difference being equal to 0 and the drifts of the second order of the first and second phase differences being not zero, or a failure of the time reference signal in response to the drift of the second order of the second phase difference being equal to 0 and the drifts of the second order of the first and third phase differences being not zero.

3. The clock module according to claim 1, wherein the processor is configured to stop controlling the main precision oscillator in response to a failure of the time reference signal being detected and to emit an alert in response to a failure of the main precision oscillator being detected.

4. The clock module according to claim 1, wherein the second oscillator is that of a microprocessor, of an field programmable gate array (FPGA) integrated circuit or of an Ethernet interface of the clock module.

5. The clock module according to claim 1, wherein the receiver module is configured to receive a time reference delivered by a satellite positioning system of a global navigation satellite system (GNSS) type, by a reference clock according to a precision time protocol (PTP) or by a local atomic clock.

6. A method comprising: the method comprising: synchronizing and generating a first clock signal of predetermined frequency with a main precision oscillator of a clock module; receiving a time reference and delivering, a time reference signal on which the main precision oscillator is controlled; and detecting a failure of the main precision oscillator or of the time reference signal by: using a second oscillator not controlled by an electronic component of the clock module to deliver a second clock signal of relatively constant predetermined frequency over a short period; measuring a first phase difference between the first clock signal delivered by the main precision oscillator and the time reference signal, a second phase difference between the first clock signal delivered by the main precision oscillator and the second clock signal delivered by the second oscillator, and a third phase difference between the time reference signal and the second clock signal delivered by the second oscillator; calculating drifts of the first order of the first, second and third phase differences measured so as to determine respective variations of the first, second and third phase differences; comparing the values of the drifts of the first order calculated with a predetermined threshold value; and detecting a failure of the main precision oscillator in response to the values of the drift of the first order of the first phase difference and of the second phase difference being each greater than said predetermined threshold value, or a failure of the time reference signal in response to the values of the drift of the first phase difference and of the third phase difference being each greater than said predetermined threshold value.

7. The method according to claim 6, wherein the first clock signal, the time reference signal and the second clock signal are 1 pulse per second (PPS), 10PPS or 1 pulse per minute (PPM) signals.

8. A non-transitory computer readable medium comprising instructions stored thereon which implement a method when the instructions are executed by a processor, wherein the method comprises: synchronizing and generating a first clock signal of predetermined frequency with a main precision oscillator of a clock module; receiving a time reference and delivering, a time reference signal on which the main precision oscillator is controlled; and detecting a failure of the main precision oscillator or of the time reference signal by: using a second oscillator not controlled by an electronic component of the clock module to deliver a second clock signal of relatively constant predetermined frequency over a short period; measuring a first phase difference between the first clock signal delivered by the main precision oscillator and the time reference signal, a second phase difference between the first clock signal delivered by the main precision oscillator and the second clock signal delivered by the second oscillator, and a third phase difference between the time reference signal and the second clock signal delivered by the second oscillator; calculating drifts of the first order of the first, second and third phase differences measured so as to determine respective variations of the first, second and third phase differences; comparing the values of the drifts of the first order calculated with a predetermined threshold value; and detecting a failure of the main precision oscillator in response to the values of the drift of the first order of the first phase difference and of the second phase difference being each greater than said predetermined threshold value, or a failure of the time reference signal in response to the values of the drift of the first phase difference and of the third phase difference being each greater than said predetermined threshold value.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Other aims, features and advantages of the present disclosure will become more apparent upon reading the following description, given by way of simple illustrative, and non-limiting example, in relation to the figures, wherein:

[0027] FIG. 1 is a schematic view of a clock module in accordance with an exemplary aspect of the present disclosure;

[0028] FIG. 2 is a frequency accuracy comparison over a period of 60 s of the OCXO precision oscillator of a clock module in accordance with an exemplary aspect of the present disclosure and of another oscillator of the clock module, referred to as opportunity oscillator, making it possible to implement an exemplary aspect of the present disclosure.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

[0029] FIG. 1 schematically shows a clock module 1 with internal precision oscillator 12, referred to as main oscillator or precision oscillator or local oscillator, which may be an oven-controlled crystal oscillator (OCXO) or an atomic clock, generating a first clock signal of predetermined frequency. This clock module 1 here is used as a frequency and time reference in digital electronic equipment 2 (a radiolocation device, for example).

[0030] This clock module 1 further comprises a GNSS frequency receiver module 11 capable of delivering, when it is active, a synchronisation signal for example 1PPS (pulse per second) of time reference that is derived from synchronisation information transmitted by the GNSS satellite systems (or others), on which the main oscillator 12 is controlled.

[0031] For this, the clock module 1 implements a system for controlling the main oscillator 12 comprising a first phase detector 14A measuring the instantaneous time difference (or phase difference) between the two 1PPS signals (or others) of the main oscillator 12 and of the GNSS reference, and a software algorithm 15B intended to compensate for the drifts of the main oscillator 12.

[0032] In normal circumstances, fluctuations of the phase difference are observed and corrected by the system for controlling the main oscillator 12. However, an abnormal behaviour of the reference or of the main oscillator would result in sudden and unexpected phase drifts or fluctuations. The key question is then to know if the problem is located with the reference, or if it concerns a problem of stability or of precision of the main oscillator.

[0033] The approach of an exemplary aspect of the present disclosure includes taking advantage of an oscillator already present in the clock module, such as the clock of the microprocessor for example. By way of example, in the latest generation of clocks of the applicant of the present application, the microprocessor called Hard Processor System (HPS) is integrated into an FPGA integrated circuit. The HPS microprocessor is clocked by a MEMS oscillator, referred to as opportunity oscillator in the following, providing a frequency signal of 25 MHz from which it is possible to generate a 1PPS signal or any other periodic signal. Of course, the clock of another component of the clock module may be used within the scope of the present disclosure.

[0034] Such an opportunity oscillator, although having a different initial aim and demonstrating much lower performances than the main oscillator dedicated to the synchronisation, here is used as a comparison tool for the main oscillator/reference system assembly. For this, the solution of the an exemplary aspect of the present disclosure includes constantly monitoring the phase difference (x.sub.hr) between the 1PPS signal generated by the opportunity oscillator (here HPS) and the 1PPS signal generated by the reference, as well as the phase difference (x.sub.ho) between the 1PPS signal by the opportunity oscillator (here HPS) and the 1PPS generated by the main oscillator, in addition to the phase difference (x.sub.or) between the 1PPS signal generated by the main oscillator and the 1PPS signal generated by the reference.

[0035] The phase measurements are therefore made from 1PPS signals (the difference at the rising front of each PPS signal is measured) by three phase detectors, referred to as first, second and third phase detectors 14A, 14B and 14C, integrated in the abovementioned FPGA integrated circuit. The second phase detector 14B measures the phase difference between the two 1PPS signals of the reference and of the opportunity oscillator 13, the third phase detector 14C measuring the phase difference between the two signals of the main oscillator 12 and of the opportunity oscillator 13.

[0036] During normal operation, the difference (or the sum according to the sign convention) x.sub.ho−x.sub.hr corresponds to the phase difference x.sub.or between the 1PPS signal of the main oscillator and the 1PPS signal of the reference. An opportunity oscillator such as the HPS oscillator is not controlled. Consequently, the values of x.sub.hr and x.sub.ho are arbitrary and may drift rapidly because the precision of the frequency of such an opportunity oscillator is typically in the order of 10.sup.−5 to 10.sup.−5. However, its instantaneous frequency drift is negligible over short periods (seconds to tens of seconds). This behaviour is illustrated in [FIG. 2] It is this key hypothesis that makes it possible to disentangle the cause of the phase problem, the opportunity oscillator being used as a relatively constant reference frequency signal.

[0037] FIG. 2 is a frequency accuracy comparison over a period of 60 s of the opportunity oscillator of the HPS microprocessor and of the OCXO main precision oscillator of a clock module used during tests performed by the applicant.

[0038] The top curve shows the fractional frequency difference of the opportunity oscillator of the HPS microprocessor over a period of 60 s.

[0039] The bottom curve represents the fractional frequency difference of the OCXO precision oscillator that is the main oscillator of the clock and that is stable over the short term. It can be seen that there are more than two orders of magnitude that separate them in accuracy, the opportunity oscillator being less accurate (both being relatively stable over 60 s). Even if the fractional frequency difference of the opportunity oscillator is not accurate and drifts over long time intervals, it may be considered as constant over short time intervals as can be seen in [FIG. 2]. It is this point that is used to implement the solution of an exemplary aspect of the present disclosure.

[0040] An abnormal behaviour of the reference or of the main oscillator results in sudden phase drifts or fluctuations. The key question is then to know if the problem is located with the reference, or if it concerns a problem of stability or of precision of the main oscillator. As highlighted above, such potential phase integrity problems are detected by taking advantage of a third-party oscillator already present in the clock module, such as the clock of the microprocessor. Therefore, another redundant oscillator is used to determine whether the problem is located with the reference or with the main oscillator.

[0041] The aforementioned phase measurements are made at an FPGA integrated circuit and the analysis of these measurements is ensured by an algorithm 15A of FIG. 1 the main steps of which are the following: [0042] the three phase values, namely the phase value between the main oscillator and the reference, the phase value between the opportunity oscillator and the main oscillator and the phase value between the opportunity oscillator and the reference, are retrieved; [0043] they are stored in a table; [0044] their first drifts are calculated according to a first approach, and their second drifts also according to a second approach, in terms of finite differences which amounts to estimating the fractional frequency differences and their variations; [0045] the absolute values of the first drifts according to a first approach are compared with a predetermined threshold value, and when this threshold value is exceeded an alert (defective main oscillator) is launched or the control of the main oscillator is stopped because it is considered that the reference is no longer valid.

[0046] More specifically, according to a first approach, the successive phase drifts (which is equivalent to the fractional frequency difference) over a sampling period r are calculated in terms of finite differences of the first order, as follows:

[00001]$\begin{array}{cc}\left[\mathrm{Math}1\right]& \\ {\stackrel{.}{x}}_{\mathrm{ho}}\left(t\right)=\frac{x_{\mathrm{ho}}\left(t\right)-x_{\mathrm{ho}}\left(t-\tau \right)}{\tau }\simeq C_h-\Delta {\stackrel{.}{x}}_o^{\mathrm{ctrl}}\left(t\right)+w_{\mathrm{ho}}\left(t\right),& \left(1\right)\end{array}$$\begin{array}{cc}{\stackrel{.}{x}}_{\mathrm{hr}}\left(t\right)=\frac{x_{\mathrm{hr}}\left(t\right)-x_{\mathrm{hr}}\left(t-\tau \right)}{\tau }\simeq C_h-\Delta {\stackrel{.}{x}}_o^{\mathrm{ctrl}}\left(t\right)+w_{\mathrm{hr}}\left(t\right),& \left(2\right)\end{array}$$\begin{array}{cc}{\stackrel{.}{x}}_{\mathrm{or}}\left(t\right)=\frac{x_{\mathrm{or}}\left(t\right)-x_{\mathrm{or}}\left(t-\tau \right)}{\tau }\simeq -\Delta {\stackrel{.}{x}}_o^{\mathrm{ctrl}}\left(t\right)+w_{\mathrm{or}}\left(t\right),& \left(3\right)\end{array}$

[0047] where w represents the random noise, C.sub.h is the fractional frequency difference error of the opportunity oscillator of the HPS microprocessor that is considered as constant over the sampling interval τ, and Δ{dot over (x)}.sub.0.sup.ctrl(t) is the frequency command applied on the main oscillator.

[0048] The frequency variation is assumed to be constant. A sudden change in the value of the frequency variation indicates a malfunction. In the case of a defective reference signal, the drifts {dot over (x)}.sub.hr and {dot over (x)}.sub.or are impacted whereas the drift {dot over (x)}.sub.ho is not. In the case of a defective signal of the main oscillator, the drifts {dot over (x)}.sub.ho and {dot over (x)}.sub.or are impacted whereas the drift {dot over (x)}.sub.hr is not. Thus, if the absolute values of the drifts {dot over (x)}.sub.hr and {dot over (x)}.sub.or are each greater than a predetermined threshold value and the absolute value of the drift {dot over (x)}.sub.ho is less than said predetermine threshold value, then it is determined that the reference signal is defective and the holdover mode is triggered. If the absolute values of the drifts {dot over (x)}.sub.ho and {dot over (x)}.sub.or are each greater than a predetermined threshold value and the absolute value of the drift {dot over (x)}.sub.hr is less than said predetermined threshold value, then it is determined that the main oscillator is probably defective and a disciplining degraded mode is triggered.

[0049] If none of these conditions is met but that a significant phase difference is calculated (that is to say if the difference of the drifts {dot over (x)}.sub.ho and {dot over (x)}.sub.hr is not zero upon resolution of the noise), a problem is detected and an alert is emitted without it being possible to identify the source of the problem (reference or main oscillator).

[0050] If no sudden change of the values of the frequency variation is calculated, then the main clock continues to be controlled by the reference (normal disciplining mode).

[0051] Thus, according to a first approach, the observation of identical simultaneous variations on two phase drifts whereas the third phase drift is not impacted makes it possible to identify an integrity problem.

[0052] However, as the drift constant of the opportunity is unknown and is not controlled by design, the implementation of a previously established algorithm with thresholds is not absolutely reliable. According to a second approach, the algorithm applies to the second drifts of the phase series (and therefore is equivalent to a fractional frequency difference drift) and not only to the first drifts of the phase series (which is equivalent to the fractional frequency difference). Thus, in order therefore to prevent the calculation of C.sub.h and to make the detection of a malfunction more reliable, the second approach consists in calculating the second drifts of the phase (or frequency variation) values in terms of finite differences of the second order as follows:

[00002]$\begin{array}{cc}{\stackrel{.Math.}{x}}_{\mathrm{ho}}\left(t\right)=\frac{x_{\mathrm{ho}}\left(t\right)-2x_{\mathrm{ho}}\left(t-\tau \right)+x_{\mathrm{ho}}\left(t-2\tau \right)}{{\tau }^2}\simeq w_{\mathrm{ho}}^{\prime }\left(t\right),& \left[\mathrm{Math}2\right]\end{array}$${\stackrel{.Math.}{x}}_{\mathrm{hr}}\left(t\right)=\frac{x_{\mathrm{hr}}\left(t\right)-2x_{\mathrm{hr}}\left(t-\tau \right)+x_{\mathrm{hr}}\left(t-2\tau \right)}{{\tau }^2}\simeq w_{\mathrm{hr}}^{\prime }\left(t\right)$${\stackrel{.Math.}{x}}_{\mathrm{or}}\left(t\right)=\frac{x_{\mathrm{or}}\left(t\right)-2x_{\mathrm{or}}\left(t-\tau \right)+x_{\mathrm{or}}\left(t-2\tau \right)}{{\tau }^2}\simeq w_{\mathrm{or}}^{\prime }\left(t\right),$ [0053] where w′.sub.or, w′.sub.hr and w′.sub.ho are random noises assumed to be Gaussian and centred on 0.

[0054] In the case of a defective reference signal, {umlaut over (x)}.sub.hr and {umlaut over (x)}.sub.or will take a non-zero value whereas {umlaut over (x)}.sub.ho will keep a zero value upon resolution of the Gaussian noise. In the case of a defective main oscillator signal, {umlaut over (x)}.sub.ho, and {umlaut over (x)}.sub.or will take a non-zero value whereas {umlaut over (x)}.sub.hr will keep a zero value upon resolution of the Gaussian noise. The threshold conditions described above are therefore adapted without needing to estimate C.sub.h, the fractional frequency difference error of the opportunity oscillator. The analysis of the second drifts of the phases with threshold conditions therefore makes it possible to identify an integrity problem in a more reliable manner than the first approach.

[0055] The first algorithm 15A receives and stores the three phase differences transmitted by the first, second and third phase detectors 14A, 14B and 14C respectively and calculates their first drifts according to the first approach and their secondary drifts also according to the second approach. It also implements the processing steps described in detail above. Based on these calculated data, a second algorithm 15B controls the main oscillator 12 through control instructions and makes it possible to compensate for the drifts of the main oscillator as is known in the prior art. The system for checking phase integrity comprises the three phase detectors, the opportunity oscillator and the first algorithm 15A.

[0056] The solution of an exemplary aspect of the present disclosure is without extra cost and makes it possible to reactively detect a problem (defect of the reference or of the main oscillator). It requires making comparisons by constructing phase differences (that is to say time differences) from two received frequencies. Every second, the phase interval is measured between the main oscillator and the reference. The same is done between the main oscillator and the opportunity oscillator, and between the reference and the opportunity oscillator. By analysing their evolutions over the short term, it is possible to determine if there is on one side or the other an integrity problem.

[0057] The solution of an exemplary aspect of the present disclosure further improves the resistance to faults and to jamming. It makes it possible to detect the integrity problems (jamming—radio waves emitted in the GNSS frequencies that dissimulate the GNSS signal or prevent its correct reception by the clock module that cannot give the time or at least that delivers an imprecise time). The precision of the time given by GNSS tends to reduce in the event of jamming until the receiver (GPS for example) no longer gives the time. As this sequence may be fairly long before this happens, this imprecise time continues to be used and the precision of the clock is adversely affected (since the reference becomes imprecise). The solution makes it possible to do without the reference in the event of defect of this type (it is better to not use the reference than use an imprecise or false reference).

[0058] An exemplary aspect of the present disclosure may implement any phase comparison, not only based on 1PPS signals. The phase measurement may be implemented for 10PPS (10 pulses per second), 1PPM (1 pulse per minute) signals or for any other periodic signal.