阅读说明：本技术 用于使一组设备同步的方法、相关联的计算机程序和同步系统 (Method for synchronizing a set of devices, associated computer program and synchronization system ) 是由 马丁·雷罗勒 米夏埃尔·唐普利耶 埃里克·菲特雷 多米尼克·马尔卡代 弗雷德里克·布朗热 于 2018-09-21 设计创作，主要内容包括：本发明涉及一种用于使包括服务器(12)和客户端(14)的互连关键设备同步的方法(24),每个关键设备通过虚拟链路(18)连接到另一关键设备,所述虚拟链路(18)的每个终点与数据分组的传输时间的最小值(BCTT)和最大值(WCTT)相关联,所述方法(24)被周期性地实施,包括：-在接收时刻(t<Sub>i</Sub>)接收消息(38),所述消息包括由发射机服务器(12)确定的至少一个时间参考(Href<Sub>i</Sub>),-对于接收到的每个消息,基于时间参考(Href<Sub>i</Sub>)、当前关键设备在当前时刻和在接收时刻的内部时钟的值(h<Sub>int_tc_di</Sub>)、所述发射机服务器和当前关键设备之间的虚拟链路的传输时间的最小值(BCTT)和最大值(WCTT)来估计(40)发射机服务器(12)的当前时间。(The invention relates to a method (24) for synchronizing interconnected critical devices comprising a server (12) and a client (14), each critical device being connected to another critical device by a virtual link (18), each end point of the virtual link (18) being associated with a minimum value (BCTT) and a maximum value (WCTT) of transmission times of data packets, the method (24) being implemented periodically, comprising: -at a reception instant (t) i ) Receive a message (38), thereforThe message comprising at least one time reference (Href) determined by the transmitter server (12) i ) -for each message received, based on a time reference (Href) i ) The value of the internal clock (h) of the current key device at the current time and at the moment of reception int_tc_di ) -estimating (40) a current time of a transmitter server (12) from a minimum value (BCTT) and a maximum value (WCTT) of transmission times of a virtual link between said transmitter server and a current key device.)

1. A method (24, 66) for synchronizing a group of interconnected critical computing devices (10), in particular avionics devices, with a communication network (16) of a vehicle such as an aircraft, and each critical computing device comprising a time management module (G _ P), the group of critical computing devices comprising at least one of a plurality of clients (14) and a plurality of time reference servers (12), each critical computing device being connected to at least one other critical computing device by a virtual link (18, 20), each termination point of a virtual link being associated with a minimum value (BCTT) and a maximum value (WCTT) of transmission times of data packets on said virtual link,

the synchronization method (24, 66) is periodically implemented and repeated by the time management module (G _ P) of each current critical computing device and comprises at least:

-receiving (38, 46, 76, 86) at least one synchronization message sent by a sending server (12) separate from the current critical computing device, each message being associated with a reception time instant (t [ ])_i) Associated and comprising at least one time reference (Href) determined by the sending server (12)_i)，

-estimating (40, 48, 58, 78, 90), for each received synchronization message, the current time of the sending server (12) according to five sets of parameters comprising:

■ the time reference (Href)_i)，

■ value of the internal clock of the current critical computing device at the current time (h)_{int_tc_di})，

■ value of internal clock of the current critical computing device at the time of reception (h)_{int_ti_di})，

■ the minimum value (BCTT) and the maximum value (WCTT) of transmission times associated with the virtual link between the sending server and the current critical computing device.

2. Synchronization method (24, 66) according to claim 1, wherein the repetition period (P) of the method is according to the following relation:

wherein:

-G (s', s) represents the time difference between the Best (BCTT) and the Worst (WCTT) theoretical transmission times of packets transmitted in a virtual link between two servers (12),

-P_Rrepresenting accuracy data corresponding to a maximum acceptable gap between said time references of two computer devices,

-D represents the internal clock (H) of the critical computing device_i) The maximum drift rate of;

-M represents the number of critical computing devices of the component.

3. A synchronization method (24, 66) according to claim 1 or 2, wherein each critical computing device further comprises a module (G _ P) for managing a synchronization fault that can be detected during implementation of the method (24, 66), and wherein, during a current period, before receiving at least one synchronization message and an estimate of the current time of the sending server (12), the method comprises:

-sending (32, 54, 72, 82), by the time management module (G _ H) of the current critical computing device to its own fault management module (G _ P), any information associated with a module for managing a fault (G _ H) of at least one sending server (12) separate from the current critical computing device and received during a previous period (P),

-performing (34, 56, 74, 84) each not yet performed action received from its own fault management module.

4. The synchronization method (24) according to claim 1 or 2, wherein the current critical computing device is a current server (12) of the plurality of servers (12), each server (12) being connected to each other server and each client by a virtual synchronization link (18),

wherein, during an initialization phase (26), prior to receiving (38, 46) at least one synchronization message and estimating (40, 48) the current time of the sending server (12), the method comprises:

-determining (34) a time reference of the current server (12) by applying a predetermined affine function to the value of the internal clock of the current server (12) at the current instant, said affine function being associated with a factor and a shift, the values of said factor and said shift starting in advance at predetermined initial values,

-sending (36) a synchronization message comprising an identification field (INIT) representing the initialization phase of the time management module (G _ H) of the current server (12) and comprising the time reference of the current server (12).

5. A synchronization method (24) according to claim 4, wherein, after performing the estimation (40) of the current time of the sending server, for each received synchronization message comprising an identification field representative of the initialization phase (INIT) of an individual sending server and being implemented as soon as a first predetermined number of synchronization messages are received, the method comprises:

-determining (42) a new time reference corresponding to a current maximum time obtained from a current time associated with each message,

-updating (44) the factor of the affine function and the displacement according to the new time reference,

-initiating (44) an operational phase (28) of the time management module of the current server.

6. A synchronization method (24) according to claim 4, wherein after performing said estimation (48) of said current TIME of said sending server (12), for each received synchronization message comprising an identification field (TIME) representative of said operating phase (28) of the individual sending server (12) and being effected upon reception of a second predetermined number of synchronization messages, said method comprises:

-determining (50) a new time reference corresponding to a current average time obtained from a current time associated with each message,

-updating (52) the factor of the affine function and the displacement according to the new time reference,

-initiating (52) an operational phase (28) of the time management module of the current server.

7. The synchronization method (24) according to any one of claims 1 to 3, wherein the current critical computing device is a current server (12) of the plurality of servers, each server (12) being connected to each other server and each client by a virtual synchronization link (18),

wherein, during the operating phase (28), the method comprises:

-for each received synchronization message comprising an identification field (TIME) representative of said operating phase (28) of the individual sending server (12):

-if the reception moment of a message is more than two periods (P) earlier than the current moment, sending a piece of information representative of an anomaly to the fault management module (G _ P) of the current client and stopping the processing of the message,

-otherwise, the estimate (58) of the current time associated with the message,

-determining (60) a new time reference corresponding to the current average time obtained from the current time of the current server and a current time associated with each message,

-updating (62) the factor and the displacement of the affine function according to the new time reference, and

-sending (64) a synchronization message comprising an identification field representing the operating phase of the current server and containing the time reference of the current server;

8. the synchronization method (66) according to any one of claims 1 to 3, wherein the current critical computing device is a current client (14) from the plurality of clients (14), each client (14) being connected to each server (12) from the plurality of servers (12) by a virtual synchronization link (18),

wherein, during an initialization phase (68), after an estimation (78) of the current TIME of an individual sending server (12) performed according to a first received synchronization message comprising an identification field (TIME) representative of the operating phase (28) of said sending server, the method comprises:

-updating the time reference of the current client equal to the current time associated with the message,

-initializing (80) initial factors and shift values of an affine function applicable to the values of the internal clock of the current client,

-initiating (80) the operational phase of the time management module of the current client.

9. The synchronization method (66) according to claims 1 to 2, wherein the current critical computing device is a current client (14) of the plurality of clients (14), each client (14) being connected to each server (12) from the plurality of servers (12) by a virtual synchronization link (18),

wherein, during an operational phase (70), the method comprises:

-for each received synchronization message comprising an identification field representative of said operational phase (68) of the individual sending server (12):

-if said moment of reception (t) of said message is present_i) Is greater than the current time (t)_c) -two or more periods (P) earlier, sending a piece of information representative of an anomaly to the fault management module (G _ P) of the current client (14) and stopping the processing of the message,

-otherwise, the estimate (90) of the current time associated with the message,

-if on the one hand by applying an affine function to the current client (C)₁、C₂) At the current time t_cIs higher than a predetermined precision threshold (P) of the absolute value of the difference between the time reference of the current client (14) obtained from the value of the internal clock and the average current time on the other hand obtained (92) from the current time associated with each message_R) -sending information representative of an anomaly to said fault management module (G _ P) of said current client,

-determining a new time reference corresponding to a current average time obtained from a current time associated with each message, and

-updating the factor and the displacement of the affine function of the current client (14) according to the new time reference.

10. A system (10) for synchronizing a group of interconnected critical computing devices, in particular avionics devices, with a communication network (16) of a vehicle such as an aircraft, and each critical computing device comprising a time management module (G _ H), the group of critical computing devices comprising at least one of a plurality of clients (14) and a plurality of time reference servers (12), each critical computing device being connected to at least one other critical computing device by a virtual link (18, 20), each termination point of a virtual link being associated with a minimum value (BCTT) and a maximum value (WCTT) of transmission times of data packets on said virtual link (18, 20),

the time management module (G _ H) of each current critical computing device is capable of performing and repeating at least periodically:

-receiving (38, 46, 76, 86) at least one synchronization message sent by a sending server separate from the current critical computing device, each message being associated with a reception moment and comprising at least one time reference determined by the sending server,

-estimating (40, 48, 58, 78, 90), for each received synchronization message, the current time of the sending server according to five sets of parameters comprising:

■ the time reference is set to the time reference,

■ internal clock value of the current critical computing device at the current time,

■ internal clock value of the current critical computing device at the time of receipt,

■ the minimum and maximum values of the transmission time associated with the virtual link between the sending server and the current critical computing device.